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THE FAIR CREDIT REPORTING ACT AND 
ISSUES PRESENTED BY REAUTHORIZATION 
OF THE EXPIRING PREEMPTION PROVISIONS 


TUESDAY, MAY 20, 2003 

U.S. Senate, 

Committee on Banking, Housing, and Urban Affairs, 

Washington, DC. 

The Committee met at 2 p.m., in room SD-538 of the Dirksen 
Senate Office Building, Senator Richard C. Shelby (Chairman of 
the Committee) presiding. 

OPENING STATEMENT OF CHAIRMAN RICHARD C. SHELBY 

Chairman Shelby. The Committee will come to order. 

I would just like to thank everyone for being here today. At the 
end of this year, the State law preemption provisions of the Fair 
Credit Reporting Act expire. This Committee has the responsibility 
of reviewing these provisions and making a determination as to 
whether they should be extended, altered, or be allowed to lapse. 

The task before us is no small endeavor. 

The preemption provisions are a part of a much larger, highly 
complex law, a law that governs crucial aspects of the consumer 
credit system. This national system is huge, involving trillions of 
dollars and millions of people, and is at the heart of the economic 
well-being of this country. 

This system is also fundamentally dependent on the collection 
and dissemination of data that involves some of our most sensitive 
personal information. 

We do want to point out, however, that balancing these various 
interests is not a new challenge for Congress. At enactment, when 
it was significantly amended in 1996, and now, the calculus behind 
the FCRA has always required consideration of the broad issues re- 
lating to the operation of the credit markets and consumer privacy. 

The statement of purpose of the Act bears this point out. It high- 
lights the banking system’s dependence upon fair and accurate 
credit reporting, the vital function consumer reporting agencies 
perform in supplying this information, and the need to ensure that 
reporting agencies exercise the grave responsibilities with fairness, 
impartiality, and respect for the consumer’s right to privacy. 

As we review the expiring preemption provisions of the law, it is 
my hope that the provisions are considered in the context of the 
law’s purpose. 

To this end, we have already held numerous staff briefings cov- 
ering many of the key topics associated with the Fair Credit 
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Reporting Act. Additionally, and more importantly, while working 
within the limited timeframe we have available, it is my intention 
to develop a comprehensive hearing record to inform the Commit- 
tee’s debate. 

We are now moving to the hearing phase and are beginning at 
what I feel is the best point of departure — consideration of the fun- 
damental issue implicated in the debate — operation of the con- 
sumer credit system and the Fair Credit Reporting Act’s role in 
that system. 

We do this by first hearing from the Federal Trade Commission, 
the Agency with the most responsibility for enforcement of the Fair 
Credit Reporting Act. Our first witness is Howard Beales, Director 
of the Federal Trade Commission’s Division of Consumer Affairs. 
From Mr. Beales, we should obtain more information about the his- 
tory, the purpose, and function of this important law. I look for- 
ward to his testimony. 

As we move forward, I plan to use these hearings to provide con- 
tent that will enable the Committee to focus its consideration on 
the discrete issues and particular applications of the law. 

It is my hope and intent that, at the end of this process, we will 
have obtained a full sense of the value of our national system and 
we will be able to balance the various issues presented by contem- 
porary information use practices. 

Our overarching goal should then be to ensure that the law pro- 
duces the most effective, efficient, balanced and fair system that is 
achievable. 

Senator Crapo. 

STATEMENT OF SENATOR MIKE CRAPO 

Senator Crapo. Thank you very much, Mr. Chairman. I appre- 
ciate your comments and share them, and I appreciate the atten- 
tion you are giving to this critical issue. 

As you indicated, we have a short timeframe within which to ad- 
dress the reauthorization of the Fair Credit Reporting Act’s pre- 
emption authority. And I believe that there is an increasingly 
strong consensus in terms of that need. 

The other issues that surround this issue as well are those which 
we need to have a solid record developed on and which I appreciate 
your encouragement and support in developing that record. 

I intend to work with you and the other Members who are inter- 
ested in this issue to prepare solutions to those issues, such as the 
privacy issues, the identity theft issues, and other related issues 
that are involved, not only in FCRA, but also in the application of 
the Gramm-Leach-Bliley legislation and our entire approach to how 
credit and the information surrounding credit is basically collected 
and utilized in our society. 

We want to make sure that the protections are in place to protect 
privacy, but at the same time, we want to make sure that our sys- 
tem of credit in the United States, which has been such a strength 
to our economy and to our people, is not interfered with. 

And I think that that task is one that is achievable and I look 
forward to working with you on it. 

Thank you. 

Chairman Shelby. I just want to make an announcement. 
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Concurrent with this hearing today, when we get a quorum, the 
Committee will conduct a vote on a lot of nominations: Nicholas 
Gregory Mankiw, of Massachusetts, to he a Member of the Council 
of Economic Advisors, the Executive Office of the President; Steven 
B. Nesmith, of Pennsylvania, to he Assistant Secretary for Congres- 
sional and Intergovernmental Relations, U.S. Department of Hous- 
ing and Urban l3evelopment; Jose Teran, of Florida, to be a Mem- 
ber of the Board of Directors, the National Institute of Building 
Sciences; James Broaddus, of Texas, to be a Member of the Board 
of Directors, the National Institute of Building Sciences; Lane Car- 
son, of Louisiana, to be a Member of the Board of Directors of the 
National Institute of Building Sciences; and Morgan Edwards, of 
North Carolina, to be a Member of the Board of Directors of the 
National Institute of Building Sciences. 

I just wanted to make that announcement at the beginning. 

Mr. Beales, we welcome you to the Committee. Your written 
statement in its entirety has been reviewed and it will be made 
part of the Senate Banking Committee’s record. 

You proceed as you wish. As I told you, we are going to get a 
vote on the floor about 2:20 p.m., or whenever we get it, and I will 
recess the Committee for the vote at the proper time. 

You proceed as you wish. 

STATEMENT OF J. HOWARD BEALES, III 
DIRECTOR, BUREAU OF CONSUMER PROTECTION 
U.S. FEDERAL TRADE COMMISSION 

Mr. Beales. Thank you very much, Mr. Chairman and Members 
of the Committee. I am pleased to have this opportunity to provide 
background on the Fair Credit Reporting Act. 

Although the views expressed in the written statement represent 
the views of the Commission, my oral presentation and my re- 
sponses to questions are my own and do not necessarily reflect the 
views of the Commission or any individual Commissioner. The 
Commission has played a central role in interpreting and enforcing 
the FCRA since the law was enacted in 1970. I really appreciate 
the opportunity to discuss the Act and its role in regulating credit 
report information. 

After World War II, the American population grew and became 
vastly more mobile. A national consumer reporting system devel- 
oped in response to this new mobility. Since that time, consumer 
credit outstanding has grown exponentially. Indeed, consumer 
spending accounts for over two-thirds of U.S. gross domestic prod- 
uct and consumer credit markets drive U.S. economic growth. 

Early on, credit reporting was local or regional and, the amount 
of information collected was limited and not standardized. The 
credit bureaus, also known as consumer reporting agencies, manu- 
ally recorded consumer information on index cards, updated the in- 
formation irregularly, and often retained it indefinitely. Over time, 
however, small credit bureaus grew to become large repositories of 
consumer information, relying on sophisticated computer systems 
to store, process and transit large amounts of data. 

Today, the credit reporting system, consists primarily of three 
nationwide credit bureau repositories, containing data on as many 
as 1.5 billion credit accounts held by approximately 190 million 



4 


individuals. Creditors and other so-called furnishers provide infor- 
mation to credit bureaus voluntarily. There is no direct payment to 
furnishers for providing this data, but the cooperative database en- 
ables credit grantors to make more expeditious and accurate credit 
decisions. Quick credit decisions are important to many consumers 
who are in the market for new credit. A recent Federal Reserve 
Board study found that one in five active credit accounts was 
opened within the last year. 

Because of the national credit reporting system we have, the 
credit application process has evolved from a relatively time-con- 
suming individualized procedure that relied on loan officers’ case- 
by-case estimates, to a more sophisticated and partial system that 
relies on consistent assessment of credit history information. 

Because of the prevalence of credit reports, consumers today can 
use the Internet to comparison-shop for a wide array of credit prod- 
ucts and get a virtually instantaneous offer. Or they can get a five- 
figure loan from a car dealer they have never seen before and drive 
a car out of the showroom the same day. 

Let me briefly review some of the key elements of the FCRA as 
it stands today, 33 years after its original passage. 

It is important to keep in mind that notwithstanding its title, the 
Fair Credit Reporting Act has always covered more than what are 
conventionally termed “credit reports.” It applies to any informa- 
tion that is collected and used for the purpose of evaluating con- 
sumers’ eligibility for products and services they want. Thus, the 
FCRA has always applied to insurance, employment, and other 
noncredit consumer transactions. My focus today will be on credit 
reporting, but the same basic regulatory structure applies to all 
consumer reports. 

The FCRA provides consumer protections in two vital areas — pri- 
vacy and accuracy. The Act is designed to protect privacy in a num- 
ber of ways. Primarily, it limits distribution of credit reports to 
those with specific “permissible purposes.” Generally, reports may 
be provided for the purposes of making decisions involving credit, 
insurance, or employment, and certain other consumer-initiated 
transactions. 

Also, Congress has given consumers the right to opt out of the 
use of their credit information for prescreening and opt out of the 
sharing of certain information, including credit reports among af- 
filiated companies. 

In addition to privacy, credit report accuracy is a core goal of the 
FCRA. Accurate reports benefit not only consumers, but also credit 
grantors who need accurate information to make optimal decisions. 

The FCRA uses two major avenues to achieve the goal of optimal 
accuracy. First, it provides that the consumer reporting agencies 
must follow “reasonable procedures to assure maximum possible 
accuracy of the information” they report. Second, the FCRA gives 
consumers the right to know what information the credit bureau 
maintains on them and the right to dispute errors, facilitated by 
the Act’s adverse action notice requirements. Since 1970, the FCRA 
has required that when credit is denied based, even in part, on a 
consumer report, the creditor must notify the consumer of the iden- 
tity of the credit bureau from which the report was obtained, of the 
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right to obtain a free copy of the report, and the right to dispute 
the accuracy of the information in the report. 

A consumer can initiate a dispute by notifying a credit bureau 
of incomplete or inaccurate information in his or her credit report. 
The credit bureau and creditor who furnished the information must 
reinvestigate the dispute, generally within 30 days, record the cur- 
rent status of the information and delete it if it is found to be inac- 
curate or unverifiable. The credit bureau must report the results 
of the investigation to the consumer. 

The self-help mechanism embodied in the FCRA’s scheme of ad- 
verse action notices and the right to dispute is a critical component 
in the effort to maximize the accuracy of consumer reports, and the 
Commission has given high priority to assuring compliance with 
these provisions. 

Let me briefly discuss the Commission’s efforts to administer and 
enforce the FCRA since 1970. When Congress first passed the Act, 
it provided that the Commission would b^e the principal agency to 
enforce the statute. 

The Commission brought a number of formal actions to enforce 
the FCRA, including cases to assure compliance with the adverse 
action notice requirements on the part of creditors and employers, 
to assure compliance with privacy and accuracy requirements by 
the major nationwide credit bureaus, and to assure compliance by 
resellers of consumer reports, which are agencies that purchase 
consumer reports from the major bureaus and then resell them. 

The Commission’s enforcement efforts since 1996 have focused on 
the new requirements added by the amendments in that year. For 
example, the Commission settled cases against the three major re- 
positories charging that they failed to have adequate personnel 
available to answer FCRA-mandated toll-free telephone numbers. 
The Commission has also settled cases against furnishers of infor- 
mation to consumer reporting agencies alleging that they falsely re- 
ported delinquency dates, causing adverse information to remain 
on credit reports past the 7-year limit provided by the Act. 

Recently, the Commission settled an action against an Internet 
mortgage lender that failed to give adverse action notices to con- 
sumers who did not qualify for online pre-approval because of infor- 
mation in their credit reports. 

The Commission is also engaged in extensive consumer and busi- 
ness education, including the Commission’s 1990 commentary on 
the FCRA. After the 1996 Amendments, our informal guidance ex- 
panded to meet the interpretive needs that were prompted by the 
amendments. We are now focused on a revision of the 1990 com- 
mentary which has been rendered partly obsolete by the passage 
of time and the amendments. The Commission will continue to use 
a combination of education initiatives and vigorous enforcement to 
foster compliance with the FCRA. 

We see several ongoing developments in the consumer reporting 
marketplace that may have significant impact on consumers. First, 
more types of businesses are using credit reports to make decisions 
in consumer transactions. For example, telephone service providers 
routinely use consumer reports to make decisions on whether to 
provide service and what deposit requirements, if any, to impose. 
Insurance companies are increasingly using the information from 
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consumers’ credit histories when underwriting homeowners and 
auto insurance policies. 

Second, we are seeing new types of consumer credit providers 
and products in the marketplace. For example, the growing use of 
prescreened offers for the marketing of credit cards has led to the 
development of credit card banks that rely almost entirely on 
prescreening to sell their cards. Prescreening has also led to the 
widespread availability of credit cards with no annual fee and other 
attractive benefits, and has enhanced competition. 

Third, businesses increasingly are using consumer reports to un- 
dertake risk-based pricing of products or services. Many creditors 
and other businesses no longer merely approve or deny applica- 
tions, but, rather, they use credit report data to finely calibrate the 
terms of their offer. Consumers benefit from the more efficient con- 
sumer credit market that is made possible by these developments. 

Any reference to the consumer reporting system should recognize 
the problem of identity theft. The range, accuracy, and timeliness 
of information in consumer reporting data bases makes them 
unique resources. They are, therefore, simultaneously a target for 
identity thieves and a valuable resources for combatting identity 
theft. Identity theft threatens the fair and efficient functioning of 
consumer credit markets by undermining the accuracy and credi- 
bility of the information flow that supports these markets. 

As I recently detailed before the House Financial Services Com- 
mittee, the Commission is working actively to combat identity theft 
in a number of areas. We will continue to explore avenues for com- 
batting identity theft and assisting victims. 

In conclusion, the 33 years since passage of the Act have fully 
demonstrated the wisdom of Congress in enacting the FCRA. 

The FCRA makes possible the vitality of modern consumer credit 
markets. The consumer reporting industry, furnishers, and users 
can all rely on the uniform framework of the FCRA in what has 
become a complex, nationwide business of making consumer credit 
available to a diverse and mobile American public. 

The 1970 Act, along with the 1996 Amendments, provided a care- 
fully balanced framework, making possible the benefits that result 
from the free, fair, and accurate flow of consumer data. All of these 
benefits depend on the consumer reporting system functioning as 
intended. That is why the FTC continues to emphasize the impor- 
tance of educating consumers and businesses, and of enforcing the 
law to assure compliance by all who have a role in making the sys- 
tem work. 

Thank you for this opportunity to present the Commission’s 
views, and I would be happy to respond to your questions. 

Chairman Shelby. Thank you. I believe at this point would be 
a good time — Senator Dole, we are having a vote at 2:20 p.m., un- 
less it has been vitiated. 

Does anybody know? It hasn’t hit yet. 

[Pause.] 

I believe I will recess the hearing — Senator Dole, do you have an 
opening statement or any comments? 
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COMMENTS OF SENATOR ELIZABETH DOLE 

Senator Dole. No. In the interest of time, I will submit my state- 
ment for the record. 

Chairman Shelby. It will be made a part of the record in its en- 
tirety. 

Senator Dole. But I welcome you. As a former Member of the 
Federal Trade Commission, I am delighted to have your testimony 
today and look forward to the questions. 

Chairman Shelby. Thank you. Senator Dole. Your opening state- 
ment will be made a part of the record. 

Senator Dole. Thank you, Mr. Chairman. 

Chairman Shelby. We will recess the Committee until we get 
back from the vote. 

[Recess.] 

Chairman Shelby. The Committee will come to order. 

Mr. Beales, starting at the most basic level, just for the record — 
this is our first hearing regarding the Fair Credit Reporting Act, 
as you know — I want to establish for the record what is covered by 
the Fair Credit Reporting Act. 

The law identifies certain kinds of personal information and it 
establishes how and by whom such information can be collected, 
transferred, and used. 

Is that correct? 

Mr. Beales. Yes, sir. 

Chairman Shelby. What would be an example of the kind of in- 
formation that is covered under the statutory scheme? 

Mr. Beales. It could be any information if it bears on eligibility 
for credit or employment. That is the basic definitional constraint. 

Chairman Shelby. Give us an example. 

Mr. Beales. The typical example is how well you repay your 
bills, so your repayment history. 

Chairman Shelby. Sure. It certainly does has probative value, 
doesn’t it? 

Mr. Beales. It certainly does. It is ultimately what the creditor 
is interested in. 

Chairman Shelby. Right. And should be. 

Mr. Beales. Right. It may also include, and typically does, public 
record information, like mortgages and liens against your property. 

Chairman Shelby. Tax liens, if any. 

Mr. Beales. Tax liens, any other kind of information, bankruptcy 
information. 

Chairman Shelby. Lawsuits? 

Mr. Beales. Lawsuits that may be picked up from public records, 
yes, any of that might be there. 

Chairman Shelby. The law restricts, as I understand it, who can 
access and use the contents of a consumer report. In other words, 
not just anyone can use it for any reason. 

Could you elaborate on that, about how use of such information 
or report is restricted, for the record? 

Mr. Beales. The fundamental restriction is that you have to 
have a permissible purpose under the statute to access the report. 

Chairman Shelby. Is permissible purpose defined in the statute? 

Mr. Beales. There is a definition. A permissible purpose would 
be to assess your eligibility for credit. 
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Chairman Shelby. Okay. 

Mr. Beales. Or for insurance purposes. Or for employment. 

Probably the broadest of the permissible purposes is in connec- 
tion with a business transaction initiated by the consumer. 

Any of those would be permissible purposes under the statute. 

Chairman Shelby. Not a fishing expedition. 

Mr. Beales. Not a fishing expedition. Not idle curiosity. 

Chairman Shelby. That is prohibited, is it not? 

Mr. Beales. That is prohibited. From the beginning, it has been 
prohibited for a credit reporting agency to provide information to 
somebody without a permissible purpose. 

The 1996 Amendments also prohibited obtaining, the act of ob- 
taining a report without a permissible purpose. 

Chairman Shelby. So that begs the question — why do you think 
access to credit reports was limited to those with permissible pur- 
poses? 

Mr. Beales. I think this is sensitive information. 

Chairman Shelby. Sensitive information. Basically, private in- 
formation. 

Mr. Beales. Basically, private information. And in order to pro- 
tect the consumer’s privacy interests, and to balance the con- 
sumer’s privacy interests against the legitimate needs of creditors 
in trying to assess whether or not to grant credit. Congress made 
the decision to enumerate the kinds of purposes for which this was 
a worthwhile use and an acceptable invasion of privacy, and elimi- 
nate the kinds of uses where there is less benefit, but the same in- 
vasion of privacy. 

Chairman Shelby. Is target marketing generally considered a 
permissible use? 

And if so, why? 

Mr. Beales. The only circumstance in which target marketing is 
a permissible use is prescreened offers of credit or insurance. 

Other than that, target marketing is not a permissible use. 

Chairman Shelby. The structure of the Fair Credit Reporting 
Act reflects decisions of earlier Congresses what weighed and bal- 
anced — tried to balance — various factors, such as privacy, accuracy, 
and commercial need for credit information. 

Could you revisit the portions of your testimony where you iden- 
tified these considerations and discuss them just for the record a 
bit further? 

Privacy, accuracy, and the commercial need for credit informa- 
tion. 

Mr. Beales. The fundamental restriction to protect privacy is to 
restrict the use of information to people who have a permissible 
purpose. Without a permissible purpose, you cannot get access to 
information in credit reports because of the concern about privacy. 

To preserve accuracy of the information, the Act has two basic 
provisions, two basic mechanisms. One that requires the credit re- 
porting agency to use reasonable procedures to assure maximum 
possible accuracy. 

And two, and maybe more important, it has a notification mecha- 
nism to consumers. If an adverse decision is based on information 
in a credit report, the consumer, who is in the best position to 
know whether that information is accurate or not, is given a notice 
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and is given the opportunity to get access to their report in order 
to determine whether or not there are errors that need to be cor- 
rected. 

Chairman Shelby. In your written testimony, you cite a 1996 
D.C. Circuit Court case where the court held that a major purpose 
of the Fair Credit Reporting Act, and I will quote: “Is the privacy 
of a consumer’s credit-related data.” 

Do you believe that this is an accurate characterization? Is pri- 
vacy a critical concern underlying the Fair Credit Reporting Act? 

Mr. Beales. Absolutely. 

Chairman Shelby. Okay. 

Mr. Beales. To balance the privacy interests against the legiti- 
mate needs for credit reporting and to assure that the information 
is accurate. 

Chairman Shelby. In your written testimony, you point out that 
the 1996 Amendments that you alluded to earlier permitted greater 
sharing of consumer report information by affiliated companies. 

To what degree was information-sharing occurring before the 
amendments were passed? And why were the 1996 affiliate-sharing 
amendments needed? 

If you go back prior to 1996, and then after, post-1996. 

Mr. Beales. I think around 1996, and I do not know precisely 
what is before or what is after 

Chairman Shelby. Okay. 

Mr. Beales. — but it seems to me that the structure of the finan- 
cial services industry was undergoing a lot of change and a lot 
more change was anticipated. 

Those changes in structure led to a lot more affiliation relation- 
ships where there is common ownership or control of different 
parts of the same, but separate, corporation. 

Chairman Shelby. Also, national in scope, too, wouldn’t it be? 

Mr. Beales. Absolutely. A lot more national in scope and a lot 
more combinations of what had previously been unrelated busi- 
nesses or businesses that were separated by regulatory require- 
ments. 

I think it was that greater combination that led to more sharing 
among affiliates because, from one perspective, there is no distinc- 
tion between being an affiliate and being different divisions of the 
same company. 

In the different divisions case, there is no restriction on sharing. 

Chairman Shelby. A legal distinction? 

Mr. Beales. Excuse me? 

Chairman Shelby. A legal distinction? 

Mr. Beales. Sure. There is a legal and organizational distinction 
and it is useful for regulatory purposes like confining risks from a 
particular kind of business or limiting the scope of deposit insur- 
ance, for example, to the deposit base in a bank. 

It is very useful for that purpose. 

Chairman Shelby. What new powers did affiliates obtain under 
the 1996 Amendments that did not exist previous to the 1996 
Amendments? 

Just off the top of your head. 

Mr. Beales. Previous to the 1996 Amendments, if you shared in- 
formation among affiliates, and the information was enough to 
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amount to a credit report, then the affiliate that was the source 
would itself be a credit reporting agency and would have to comply 
with the full panoply of requirements of the statute. 

So if the banking arm shared an application with the subprime 
lending arm of the same company, it would itself be a consumer re- 
porting agency and subject to all of the other requirements of the 
FCRA. 

After the 1996 Amendments, that kind of information sharing 
was exempted as long as the consumer has the right to say no and 
prevent the information sharing. 

It was exempted from the definition of a consumer report. 

Chairman Shelby. How does that work? You say the consumer, 
as long as the consumer has the right to say no to the sharing. 

Is that at the outset or is it when something comes up? 

Mr. Beales. It could be at either point. What the statutory re- 
quirement is, is that the consumer be given the right to opt out and 
that opt out or that giving of the right either occur up front at the 
time the relationship is initiated, or it could occur at any subse- 
quent point. 

What has happened with Gramm-Leach-Bliley, since Gramm- 
Leach-Bliley, is that many companies have provided the notice and 
the opt out for the Fair Credit Reporting Act as part of the annual 
Gramm-Leach-Bliley notice. 

Chairman Shelby. I will get back in another round. 

Senator Carper. 

STATEMENT OF SENATOR THOMAS R. CARPER 

Senator Carper. Thank you, Mr. Chairman. 

And to our witness — do you pronounce your name “heals”? 

Mr. Beales. Yes, sir. 

Senator Carper. Welcome aboard. As you know, probably better 
than us, when the FCRA was passed by Congress, there was a sun- 
set provision that causes us to come back and to revisit the issue. 
That sunset gives us the opportunity to do so. 

I missed your testimony. And I am just going to ask, if you will, 
just to take maybe one minute and say, if there is nothing else that 
you walk out of here remembering that I have said, this would be 
the one or two or three things. 

Can you start with that? 

Mr. Beales. I think this is an important decision. I think the 
way the credit reporting system functions is really vital to the func- 
tioning of credit markets. And that, in turn, is vital to the func- 
tioning of the American economy. Consumer spending is a huge 
chunk of the economy. 

I think that this is an important statute that struck a very rea- 
sonable and time-tested balance between the conflicting interests of 
consumer privacy and the legitimate needs of businesses for infor- 
mation. I think it is a balance that has stood the test of time since 
the statute was originally enacted. I think the accuracy provisions 
of the statute are a key component. That has been a crucial aspect 
of our 

Senator Carper. Could you talk a little bit about that, please? 
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Mr. Beales, could you hold the microphone — usually, we ask peo- 
ple to bring it closer. I am going to ask you to bring it further 
away. 

Thank you. You have a booming voice. 

[Laughter.] 

You could probably get by here without that mic. 

[Laughter.] 

Mr. Beales. Too much time in a classroom. 

[Laughter.] 

Yes, there is two key provisions about accuracy, two key mecha- 
nisms for providing accuracy. 

The credit reporting agencies themselves are required to have 
reasonable procedures to assure maximum possible accuracy. And 
that is one of the key requirements, to make sure that information 
is correct. 

Maybe more important is the requirement for adverse action no- 
tices to consumers when a decision is based on information in a 
credit report. That lets the consumer know the source of the infor- 
mation was a credit report, where that credit report is, and it gives 
the consumer access to that credit report to examine it and see if 
there is any mistakes. 

And it is the consumer, after all, who is in the best position to 
know and has absolutely the right incentives to try to make sure 
that the information is accurate and reflects their credit history 
appropriately. 

Once the consumer indicates that there is a problem, or disputes 
an item, credit bureaus have to reinvestigate, furnishers have to 
reinvestigate, and unless the information can be verified as accu- 
rate, it has to be deleted. 

But I think that those are the two key mechanisms that address 
accuracy. 

Senator Carper. Let me ask your thoughts on whether or not — 
if we permit December 31 to come and go and we do not restore 
the preemption provisions, what do you think are the downsides to 
our failure to act, and what, if any, are the upsides? 

Mr. Beales. The Commission hasn’t taken a position on what 
you should do. 

I think that the failure to renew the preemptions runs the risk 
that what is now a national system begins to fragment, that it does 
so in ways that make it harder to share information across state 
lines and within what are increasingly national credit markets. 

I believe the potential benefit of allowing the preemption to ex- 
pire, would be letting States innovate with different approaches 
and try out different schemes to try to protect consumers or to try 
to balance these conflicting interests in slightly different ways. 

And as I say, the downside of that is we may not like some of 
those experiments and they may interfere with the uniformity that 
we currently enjoy in credit markets. 

Senator Carper. Looking back, I was not here when the preemp- 
tion language was adopted. But why was it adopted? 

Mr. Beales. I was not involved in that debate, either, and I do 
not know. 
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Why was it adopted? I think it was in order to assure the uni- 
formity of some key aspects of the system. And it certainly has ac- 
complished that. 

Senator Carper. Is the rationale for taking that action any less 
relevant or correct today? 

Mr. Beales. I think that remains the benefit of extending pre- 
emption, is that you assure the continued uniformity of the system. 

That, however, limits the ability of States to try other approaches 
and experiment with other approaches that may teach us some- 
thing. 

Senator Carper. All right. My time is expired. Mr. Chairman 
will there be another round? 

Chairman Shelby. Sure. 

Senator Carper. Thank you. 

Chairman Shelby. Senator Dole. 

I think she was here first. 

Senator Dole. Thank you. The average American moves, I am 
told, every 6 years. That is more than two-thirds higher than any 
other country. 

I think you would agree that our national uniform credit system 
plays a significant role in increasing the mobility of labor and the 
ability of consumers to move, while they preserve the opportunity 
to get cheap credit through the portable credit system. 

But tell me how important do you think this is to our economy? 

Mr. Beales. It is hard to know, and actually, we are very much 
looking forward to some research that is in the works on what the 
consequences would be of losing some kinds of information out of 
the credit reporting system. 

And I think that will be very interesting to see, and we will be 
able to have a much firmer assessment once that research is con- 
cluded. 

But I think it clearly makes it easier to be able to move to a new 
town and it doesn’t matter that there is no one there who knows 
you and can vouch for you, that there is access to a credit report 
from elsewhere with a system that creditors know they can depend 
on to provide accurate and complete information upon which to 
base a decision. 

If you had to go to a separate State or systems, it would be far 
more difficult and far more uncertain for the creditor, which in 
turn would likely get reflected in worse terms offered to the con- 
sumer. 

Senator Dole. Now, I have heard the case made that other mod- 
ern economies throughout the world, in Europe, in Latin America, 
and Asia, do not have credit reporting systems like ours, and that 
some countries are considering right now adapting our system, our 
credit reporting system, the preemptions. 

Can you provide the Committee with some details of how our 
credit reporting information or information-sharing system would 
contrast with other countries’, in the G8, for example? 

Mr. Beales. Just speaking generally, and not about any par- 
ticular country, probably, there is two kinds of differences between 
the U.S. system and various foreign systems. 

One, our system is voluntary. In some countries, credit reporting 
is essentially a public utility or provided by the government, even 
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in some instances. Our system is voluntary, market-driven. It de- 
pends on what information furnishers are willing to provide to 
credit bureaus and what information credit bureaus think it is im- 
portant to try to get and provide to their customers. 

Second, ours is a system of full-file reporting. Both positive and 
negative information about the consumer is reported. A number of 
other countries only have negative information reported. 

What is important about full-file reporting is there is a real dif- 
ference between someone who has no negative information because 
they have never had credit before, and someone who has no nega- 
tive information because they have had credit extensively, they 
have used numerous different accounts, and they have always paid 
them off. Those two people aren’t the same. But in a system that 
only reports negative information, you cannot tell them apart. 

So the full-file reporting is a really useful feature of the Amer- 
ican system. 

Senator Dole. And finally, could you just give us a run-through 
of what credit card pricing might look like without prescreening? 
Say prior to 1990, compared to today. 

Mr. Beales. It is difficult to attribute causality to any of the 
changes that have happened since 1990. But what credit card pric- 
ing looked like in 1990 was essentially everybody offered an inter- 
est rate that was at the legal usury ceiling. 

Cards generally had relatively high annual fees. There were no, 
or virtually no, ancillary benefits. You did not get airline miles. 
You did not get discounts. You did not get free insurance. 

What you see today is a wide variety of rates, of credit limits, 
numerous cards with no annual fees, a lot of different benefits, 
whether it is contributions to your favorite charity or the ability to 
display the logo of your school or even cash discounts in some 
cases. And interest rates that reflect much more closely the risk 
that a particular consumer creates or poses for the creditor. 

I think prescreening has been an important part of that shift. It 
has been an important competitive weapon, as people have entered 
credit card markets with different kinds of terms. 

But there is also obviously a lot of other changes that have hap- 
pened that have likely influenced those developments as well. 

Senator Dole. Okay. Thank you, Mr. Chairman. I think my time 
is expired. 

Chairman Shelby. Thank you. 

Senator Johnson. 

COMMENTS OF SENATOR TIM JOHNSON 

Senator Johnson. Thank you, Mr. Chairman. I have a full state- 
ment that I would like to submit for the record. 

Chairman Shelby. It will be made a part of the record, without 
objection. 

Senator Johnson. I want to thank the Chairman for holding this 
hearing. Thank you, Mr. Beales, although I have to express dis- 
appointment that the Administration has, so far, been unwilling to 
exert greater effort at pushing for passage of legislation to extend 
the preemption. 
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My own view is that a failure to act on the preemption hy Janu- 
ary 1, 2004, will he utterly disastrous for the economy of this coun- 
try and for consumers all over America. 

A uniform reporting system that could break into as many as 50 
reporting systems, all with different standards, different require- 
ments, different procedures, and a credit reporting system which in 
many ways has become a model for the world, would be degraded 
significantly. 

I think that while there are those who want to utilize this nec- 
essary legislation as a vehicle for taking up other issues, and I re- 
spect that, I would hope that the Senate will keep a close eye on 
the notion that what is at stake here is access to credit. 

And that is the principal reason why we are having this debate, 
and the uniform system, in fact, in full-file reporting has enhanced 
citizens’ ability to secure credit, has enhanced the ability of finan- 
cial institutions to make intelligent decisions relative to lending. 

Now, Mr. Beales, can you tell us whether this evolution of the 
credit reporting industry and the FCRA has resulted in personal 
credit histories being more portable? 

In other words, if someone applies for credit out of State, or 
moves a residence and applies for credit in their new home State, 
does that create any problems related to credit histories or obtain- 
ing reliable credit report information under what we have now — 
a uniform, full-file reporting system? 

Mr. Beales. No. I think the current system clearly facilitates ex- 
actly that kind of transaction. It facilitates a bank in California 
competing for the business of a consumer in Florida or Maine, and 
having reliable information about whether that consumer is a good 
risk or a bad risk. 

It facilitates the ability of that consumer to move from Florida 
or Maine to California and reestablish credit with new accounts, 
with merchants that have never heard of them before, because 
there is a uniform system that provides reliable information and 
creditors know that they can rely on that information to make an 
accurate risk assessment. 

Senator Johnson. So this system, better than a 50 different 
standards system, best facilitates dealing with the problems of a 
very mobile society. 

Would you say that that is a fair statement? 

Mr. Beales. Yes. I mean, I think the uniformity really facilitates 
mobility. I think that is probably right. And that is the benefit side 
of having a uniform system. 

Senator Johnson. And you note in your testimony that a Federal 
Reserve study of credit bureau files found that nearly 20 percent 
of currently reported active accounts have been open for fewer than 
12 months. And you concluded that this number illustrates how a 
national credit system enables creditors to make better credit- 
granting decisions. 

Could you explain that conclusion a bit more and elaborate a bit 
on why those statistics and that uniformity is so key for credit- 
granting decisionmaking? 

Mr. Beales. What we have heard, and I think the point we are 
trying to make was simply this — what we have heard in the con- 
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text of identity theft debates in particular is maybe credit shouldn’t 
be so easy. 

I think the point of that statistic is that for a large fraction of 
the population, because they are opening new accounts all the time, 
easy access to credit is an important issue, that you do not want 
to make access to credit more difficult, given how many people are 
opening accounts on an ongoing basis. 

Senator Johnson. Do you think there has been enough done to 
investigate and prosecute identity theft crimes? And what are some 
of the impediments to investigating and prosecuting identity theft 
crimes? 

Mr. Beales. We are continuously working to do more to provide 
information to assist law enforcement in prosecuting identity theft. 

We are also active in trying to educate consumers as to how they 
can reduce the risks and how they can reduce the consequences, 
and I think that is an important part of it. 

And we are very involved in assisting businesses to try to reduce 
the risks, both from a business education perspective, to try to re- 
duce the risks that information that is entrusted to them would be 
used to compromise somebody’s identity. 

We have also gone after businesses on security grounds, where 
we thought that there was not sufficient security in place to protect 
sensitive information about the consumer. And that, too, has impli- 
cations for identity theft. 

And we have an ongoing program of training law enforcement of- 
ficials in order to help them better bring identity theft kinds of 
cases. 

Senator Johnson. I notice my time is expired, Mr. Chairman I 
have some other things that I am interested in in terms of 
prescreening and credit cards and how a national system facilitates 
that. 

Chairman Shelby. We will have other rounds. 

Senator Johnson. But I will wait for a later time, and I yield 
back. 

Chairman Shelby. Senator Bunning. 

STATEMENT OF SENATOR JIM BUNNING 

Senator Bunning. Thank you, Mr. Chairman. I have an opening 
statement that I would like to submit for the record. 

Chairman Shelby. It will be made part of the record in its en- 
tirety, without objection. 

Senator Bunning. Thank you. Since FCRA enactment in 1996, 
did the same number of complaints on FCRA-related issues to the 
FTC increase, decrease, or stay the same? 

Mr. Beales. Our reporting system has changed so much over 
that time period, that I am not sure you could draw comparisons 
from that. 

I do not know, but we would be happy to supply that information 
for the record of what the numbers of complaints have been like. 

Senator Bunning. Okay. 

Mr. Beales. But I do want to note that the changes in our infor- 
mation system have really made it harder to make those compari- 
sons over time. 
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Senator Bunning. Do you believe nonpassage of FCRA will lead 
to a Balkanization of privacy laws? 

Mr. Beales. I think it depends on what the States do. One can 
imagine a scenario in which there is no preemption and no State 
action and nothing changes. 

I think it is crucially dependent on what the States do as to what 
the likely impact of not having preemption would be. 

Senator Bunning. In other words, each individual State could do 
their own thing, then. 

Mr. Beales. Right. In the absence of preemption 

Senator Running. Yes. 

Mr. Beales. — each individual State could do their own thing. 
But each individual State could also choose to maintain the status 
quo. And that is the sense in which the consequence of not having 
preemption depends on what kinds of changes States try to make, 
are interested in making, and actually do make. 

Senator Running. Would you like to venture a guess 

[Laughter.] 

— about States and preemption? 

Mr. Beales. I think the likelihood is that they would try to do 
various things. Some more sensible than others. 

Senator Running. Thank you. 

[Laughter.] 

Do you receive prescreening complaints? If so, did you receive 
more before FCRA enactment, or after? 

Mr. Beales. Prescreening — we do get prescreening complaints. 
My recollection is that we do not get very many of them. 

Prescreening is something that, although it was codified in 1996, 
under FTC interpretations going back to 1973, prescreening was 
permissible under the Fair Credit Reporting Act. 

So there really wasn’t any change or wasn’t much of a change to 
give rise to a before and after. 

In fact, what the 1996 Amendments did was to codify the ability 
to prescreen and to make it a little bit less restrictive in terms of 
how firm the offer had to be than the FTC’s staff opinions had 
been. 

Senator Running. Okay. A follow-up — do you believe 
prescreening has helped or hurt the consumer in regards to the 
credit card market? 

Mr. Beales. I think that prescreening has facilitated more com- 
petitive credit markets, and that that has been very good for con- 
sumers. 

Senator Running. Do you think that it is helped? 

Mr. Beales. Yes, I do. 

Senator Running. And you offer as fact, what? 

Mr. Beales. The changes that have occurred in the nature of 
credit card offers 

Senator Running. If you could stop them from coming once a 
day, I would really appreciate it. 

[Laughter.] 

Mr. Beales. You can do that because there is an opt out number 
that will let you opt out of prescreening offers. 

Senator Running. That is done statewide, though. 

Mr. Beales. It is done nationwide. 
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Senator Running. It is done nationwide now? 

Mr. Beales. It is done nationwide. That was part of the deal for 
the codification of the ability to prescreen, was every one of those 
prescreening offers, if you read all the fine print in it, tells you that 
you can opt out and lists the numbers. 

It is 888-5-OPTOUT. 

Senator Running. 888 

Mr. Beales. 5-OPTOUT. 

Senator Running. — 5-OPTOUT. 

Mr. Beales. And that will get you out of all prescreened offers. 

Senator Running. Thank you. 

[Laughter.] 

Mr. Beales. Glad to be of assistance. 

[Laughter.] 

Senator Running. I really appreciate that because once a day is 
too often. 

[Laughter.] 

Thank you, Mr. Chairman. 

Chairman Shelby. Senator Sarbanes. 

STATEMENT OF SENATOR PAUL S. SARBANES 

Senator Sarbanes. Thank you very much, Mr. Chairman. 

First of all, I want to commend you for holding this hearing. I 
know you are planning to hold a comprehensive series of hearings 
on this subject and invite a wide variety of interested parties to 
testify and I look forward to hearing from them. But I think it is 
important to comprehensively review this important issue. 

I also should express thanks to the thorough approach at the 
staff level. There have been a number of staff briefings in prepara- 
tion for examining these issues. 

Of course, the preemption provisions of the Fair Credit Reporting 
Act, not the Act itself, just the preemption provisions, sunset on 
January 1, 2004. 

The Fair Credit Reporting Act itself serves an important pur- 
pose. It helps to ensure privacy of consumer financial data, accu- 
racy of credit report information, and fair practices in the collection 
and use of credit information and in credit granting. 

This, of course, affects millions of Americans as they purchase 
homes, obtain insurance, seek new lines of credit, even apply for 
some types of jobs. 

Actually, the Fair Credit Reporting Act itself, at its core, is a con- 
sumer protection statute. Obviously, that is why I think it comes 
under the jurisdiction of the Bureau of Consumer Protection of the 
Federal Trade Commission, which Mr. Beales heads up. 

It protects the consumers by regulating the activities of credit re- 
porting agencies, defining the responsibilities of both the users of 
consumer reports and those who furnish consumer information to 
credit reporting agencies. And of course, it provides important 
rights to consumers affected by such reports. 

The preemption provisions, of course, cover a number of areas 
and as a consequence, some important issues that I anticipate we 
will be addressing during these hearings and throughout the reau- 
thorization process, will be the protection of consumers’ financial 
privacy, accuracy of credit reports, marketing practices of creditors. 
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credit scoring and the use of credit scores, fraud and identity theft, 
and of course, the availability and cost of credit. 

Mr. Chairman, I look forward to working with you as we embark 
on this comprehensive set of hearings. 

Now I would like to ask just a couple of questions of the witness. 
I am going to ask some very elemental questions. You are the pro- 
fessional. I want you to take us through the process. 

I want to get a copy of my credit report and my credit score. How 
do I do it? 

Mr. Beales. To get your credit report, you call one or more of 
the national credit reporting agencies and ask for a copy. 

There is a verification procedure to go through. In some cases, 
it may be easier if you write. And under Federal law, you can ob- 
tain that report for a fixed price that is set by regulation of the 
Federal Trade Commission, and they will send it to you. 

Senator Sarbanes. What is that price? 

Mr. Beales. Nine dollars 

Senator Sarbanes. Nine dollars. 

Mr. Beales. — is the Federal requirement. Now in some States, 
that report is free. But in other States, the Federal law sets the 
price at $9. 

Senator Sarbanes. And would you counsel me to get a copy of 
my credit report from each of the credit-rating agencies? 

Mr. Beales. If you are facing a major financial decision where 
the quality of your credit is going to be important — if you are going 
to refinance, if you are going to buy a home for the first time — I 
certainly would. 

It is well worthwhile to look at all three credit reports and make 
sure that the information in there is accurate. 

On a routine basis, it depends on whether — absent some impend- 
ing transaction where you know this is going to matter, it depends 
on — it is up to you. It depends on how risk-adverse you are and 
how much you want to worry about how you want to balance the 
difficulty of going through the report and the hassle of getting it, 
against the risks of some inaccurate information that might be 
there. 

If you get notified unexpectedly that there was an adverse action, 
then surely, it is worth your while to look at that report. 

Then it is free. And make sure the information is accurate. 

Senator Sarbanes. And how do I get my credit score? 

Mr. Beales. Your credit score may or may not be disclosed. It 
depends on the practices of the credit reporting agency. 

Your credit score, although we talk about it that way, may be ac- 
tually any one of a variety of different proprietary products with 
different lenders, different creditors having their own scoring sys- 
tems that they think work better for them. 

Senator Sarbanes. When I get this instantaneous credit that 
people refer to, that keep the wheels of commerce moving, is it the 
credit score that the creditor relies upon? 

Mr. Beales. The credit score is likely a key part of that. 

Senator Sarbanes. Because it is all — you know, they tell you 
that it is done right away. You are there. You want to make this 
purchase. You want to get a car, so you tell the guy and they check 
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it out and the next thing you know, they come hack and they say, 
okay, you can go ahead. 

But they must just he working off the credit score in a situation 
like that, aren’t they? Or not? 

Mr. Beales. Not necessarily. The way the system works, essen- 
tially, in all probability, the whole credit report goes — it is clearly 
an automated process that the creditor is using to decide on the 
spur of the moment whether to approve or not. 

But that may be an automated system based on the credit score. 
Or it may be a system that is based on a computer program that 
looks at all the information in the file and says, yes or no. 

That can happen pretty quickly as well. 

Senator Sarbanes. Mr. Chairman, I see my time has expired. 

Chairman Shelby. If we can suspend for a minute. I told you 
earlier that we are going to proceed with marking up the nomina- 
tions. 

We have a quorum. 

We have before the Committee now some nominations. The Com- 
mittee will meet in Executive Session to consider and hopefully 
vote on a number of nominations pending before the Committee. 

The nominees are: Nicholas Mankiw, to be Member of the Coun- 
cil of Economic Advisors; Steven B. Nesmith, to be Assistant Sec- 
retary for Congressional and Intergovernmental Relations, U.S. 
Department of Housing and Urban Development; Jose Teran, 
James Broaddus, Lane Carson and Morgan Edwards, to be Mem- 
bers of the Board of Directors of the National Institute of Building 
Sciences. 

Each of the nominees appeared before the Committee on May 13. 

Is there any comment or debate about the nominations? 

[No response.] 

If not, I ask unanimous consent that the nominations be consid- 
ered en bloc. 

[No response.] 

Hearing no objection, so ordered. 

All those in favor of the nominations, say aye. 

[A chorus of ayes.] 

Those opposed, no. 

[No response.] 

The ayes appear to have it and the nominations will be favorably 
reported to the full Senate. 

Thank you for your indulgence. 

Senator Sarbanes. Mr. Chairman, my time has expired. 

Chairman Shelby. Senator Crapo, do you have any questions? 

Senator Crapo. Thank you, Mr. Chairman. I will pass. 

Chairman Shelby. Senator Bennett. 

STATEMENT OF SENATOR ROBERT F. BENNETT 

Senator Bennett. Thank you, Mr. Chairman. And thank you for 
holding this hearing. 

I do not know of many issues quite like this one where a number 
of people whose judgment I respect have come to me and said, if 
we do not extend the preemption section of the Fair Credit Report- 
ing Act, there will be serious, serious economic consequences. Some 
have said to me, failure to do that will throw the economy back 
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into a recession. No one has been to lobby me on the other side, 
which I find kind of interesting. 

And so, if indeed it is that serious, and Chairman Greenspan has 
indicated that he thinks it might be that serious, although he 
stopped short of predicting a recession — Chairman Greenspan al- 
ways stops short of predicting anything that specific one way or the 
other. 

My first question, then, Mr. Beales, is we have had this Act in 
place for 30 years, it was updated 7 years ago in 1996, is there any 
problem that has come up, particularly since 1996 forward, since 
that is the most recent change that cries out for mediation or that 
says we have had all of these difficulties and it is absolutely essen- 
tial that we let this thing lapse in order to avoid these difficulties? 

Have the last 7 years of history told us that we have a challenge 
here? 

Mr. Beales. I do not see anything in the last 7 years that would 
indicate a significant problem or a compelling reason to change, ex- 
cept that the clock has run and the statutory provision is expiring. 

There is certainly thing that I would point to to say, based on 
this experience, there is something that you need to do differently. 

There may well be places where the balance that the Act strikes 
between privacy and the needs of commerce could be struck dif- 
ferently or fine-tuned in various ways. At this point, the Commis- 
sion hasn’t made any recommendations for changes. 

But there are certainly things that I see that would lead me to 
say that there is a pressing need for change. 

Senator Bennett. When I first came to the Banking Committee, 
one of the issues that we spent a good deal of time on was the chal- 
lenge of making more credit available, particularly to minorities. 

We had experts who came in here who had organized banks that 
loaned almost exclusively to minorities. We have had many some- 
what heated discussions in this Committee about CRA and its role 
in making credit available to minorities. 

If indeed we got the Balkanization you were discussing with Sen- 
ator Bunning, and which many people think would happen, 
wouldn’t one side effect of that be to reduce the availability of cred- 
it to minorities? 

Mr. Beales. If you got significant Balkanization, I think it would 
likely reduce the availability of credit. How selective that would be, 
whether there would be a differential impact on minorities versus 
everybody else, is harder to assess, and I think it would ultimately 
depend on the kinds of actions States took and the kinds of restric- 
tions that were put in place. 

I am sure there are some restrictions that likely would differen- 
tially affect minorities or lower-income people and their access to 
credit. There is probably other restrictions that States might adopt 
that would have differential effects the other way. 

Senator Bennett. My own sense of things based on all of the 
previous discussion that I referred to is that this probably would, 
in fact, have a chilling effect on credit being available to minorities. 

I have a chart here which you cannot discern that far away, if 
for no other reason than that the difference between the light gray 
and the dark gray is absolutely indistinguishable more than 10 
inches away from the chart. 
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So, I have a hard time seeing it myself. 

Senator Sarbanes. That is a very helpful chart. 

Senator Bennett. Yes, very helpful. 

[Laughter.] 

You can see the top bars going up and that is the total amount 
of household credit. And in 1960, it was just under 60 percent. Now 
it is over 100 percent. 

However, the lighter area underneath shows the amount of con- 
sumer credit. The darker part of the bar is mortgage credit. And 
the consumer credit has remained relatively stable in that period. 

In 1960, it was at the lowest percentage of household income. 
Looking at this, I would say it was probably at about 16 percent. 
It went up maybe to 17 or 18 percent in 1970 and stayed there all 
the way through. 

But now, it has gone up in 2002, a 12-year period, from 1990 to 
2002, to just over 20 percent. 

But mortgage, which is the top part of the bar, has gone up very 
dramatically. In 1960, mortgage credit as a percentage of dispos- 
able income was less than 40 percent and now it is more than 80 
percent. So the mortgage portion of household credit has gone up 
enormously. 

Now, I am not suggesting there is a cause-and-effect relationship 
here with the Fair Credit Reporting Act just because this is done 
during that period. We get into trouble with that around here be- 
cause we put up charts that show cause-and-effect relationship de- 
pending upon what point we want to make on the floor. 

However, the final question I would ask you is whether or not 
the ability to get a mortgage in a timely fashion would be affected 
adversely if we did not renew the preemption part of this bill? 

Mr. Beales. I think it depends. It depends in part on what states 
do. It depends, in part, on the kind of a consumer you are. 

If you have never moved and you have lived in one area your 
whole life, then even a completely State-specific system is not nec- 
essarily going to make much difference to you. 

If you have lived in 20 different places in the last 20 years, and 
your credit history is scattered all over across lots of different 
States, and is not accessible across State lines because of different 
State restrictions, it is going to have a much more dramatic impact 
in that circumstance. 

I think what may be the most important part of the statute in 
terms of how it is impacted minority credit in particular, or credit 
at lower incomes, is prescreening that lets creditors identify con- 
sumers who are good risks and compete for that business. 

Senator Bennett. I see my time is expired. But I had exactly the 
experience that Mr. Beales is discussing, Mr. Chairman. 

I bought a house in California, having lived in California pre- 
viously, and it was approved virtually in an afternoon. 

Then I had reason to move to the State of Utah, and it took me 
close to 60 days to get this thing approved in the State of Utah. 
And I finally had to have my father go down and wave his credit 
record, which was sterling compared to mine, and cosign the loan 
before we got it taken care of 

That was before we had the legislation that we are all living 
under. 
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So, I have had personal experience with how difficult this can be. 

Senator Sarbanes. They are very careful there in Utah. 

[Laughter.] 

Chairman Shelby. Very careful. 

Senator Bennett. Well, they were. 

[Laughter.] 

Chairman Shelby. Senator Miller. 

STATEMENT SENATOR OF ZELL MILLER 

Senator Miller. Thank you, Mr. Chairman. 

Thank you, Mr. Beales. 

This is something that I should know, but I do not. 

There is a lot of things like that. 

[Laughter.] 

But this is one. And I may be the only one in this room that 
doesn’t. 

What I am asking is, what exactly is the jurisdiction that the 
FTC — I know what it stands for. Federal Trade Commission — but 
what jurisdiction do you have over the Fair Credit Reporting Act? 

I know people can call up and get answers to questions and that 
you provide education on the FCRA. I know that you can give guid- 
ance and advice. 

I assume that somewhere in there, there is also some enforce- 
ment jurisdiction. 

Is that correct? 

Mr. Beales. That is correct. 

Senator Miller. And if so, talk to me a little bit about that. 

Mr. Beales. We are, I would say, the principal enforcement 
agency under the Fair Credit Reporting Act. The credit reporting 
agencies themselves are subject to our jurisdiction. 

Banks that are regulated by other agencies are regulated under 
the Fair Credit Report by those other agencies. But for other credi- 
tors, we are the chief enforcement agency and the chief regulatory 
agency. 

Senator Miller. And I think you answered this question a while 
ago. You say that you have no legislative remedy that you would 
recommend to the Senate Banking Committee when it comes to 
looking at the FCRA bill. 

Mr. Beales. The Commission has not made any recommenda- 
tions at this point. 

That is correct. 

Senator Miller. Thank you. 

Chairman Shelby. Senator Dodd. 

STATEMENT OF SENATOR CHRISTOPHER J. DODD 

Senator Dodd. Thank you, Mr. Chairman. And thank you for 
holding this hearing. And I support the notion that Senator Sar- 
banes raised and we are going to hear some more later on. But I 
think this is very helpful. 

And I want to commend Mr. Beales, too. Your testimony is very, 
very good, very helpful as well. And I am quite confident that we 
can craft a good piece of legislation. 
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On balance, Mr. Chairman, the FCRA has done much to improve 
a formerly fragmented situation that was basically a regional sys- 
tem, but now, of course, a national system of credit reporting. 

But like several of my colleagues, we have some concerns about 
how consumers are treated under this regime. 

And at least I hope that the Committee will closely examine how 
to better protect consumers as part of this and any discussion of 
reauthorization. 

I am going to send around to my colleagues, the major news- 
paper in my State, the Hartford Courant, has just run a series of 
articles, Mr. Chairman, on the whole credit question. 

I do not know if you have seen these or not at all. Have you seen 
them? 

Mr. Beales. I have, yes. 

Senator Dodd. They are rather good articles, I thought. 

I would be interested, at some point, in your response to the sug- 
gestions in them, the comments in them. They are rather com- 
prehensive. 

Two reporters spent months looking at the issue of fair credit re- 
porting, a 4-month investigation, culminating in the series I men- 
tioned, which detailed the day-to-day problems that consumers face 
with the current system. 

I am going to send around a package of these articles for my col- 
leagues to look at. 

Chairman Shelby. Good. 

Senator Dodd. The articles focus on the devastating effects that 
inaccurate information in credit reports can have on the lives of 
millions of people. Individuals are finding that it can take years of 
time and money to clear the mistakes that credit reporting agen- 
cies are making. And after finally improving the inaccuracy of their 
reports, many consumers are then left footing the bill in recovering 
from the damages caused from their records. 

As America’s financial consumers have more credit options avail- 
able to them, and as the mass of improvements in technology have 
occurred, I am concerned that the credit reporting system and the 
regulations that govern it may not have kept pace to ensure a cor- 
responding level of accuracy. 

I think we can do a better job ensuring the consumer’s financial 
picture is more accurately kept and that the process to correct mis- 
takes is faster and easier for consumers. 

Additionally, I think that we can improve the current privacy 
protections available to consumers. 

Consumers are concerned that no significant changes will be 
made to the current system. According to the same article that I 
mentioned, cracks in the system continue to put millions at risk. 

We need to fill those cracks. I think we all want to do that, with 
the national credit reporting system, and shore up its foundation. 

I thank the Chairman again for holding the hearing. 

Let me ask, if I can, a couple of things. One is, in response to 
Senator Miller and I guess previous questions, you have indicated 
that you do not believe there is any greater statutory needs that 
you would have to address the inaccuracy issue. 

Is that correct? 
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Mr. Beales. I think the fundamental accuracy mechanisms in 
the statute have, by and large, worked pretty well. I think it is just 
in the processes, as many transactions as the credit reporting sys- 
tem does, is almost inevitably going to sometimes make mistakes. 
And what is really important is to have a mechanism to correct 
those mistakes when they occur. 

I think the mechanism that is there, by and large, works pretty 
well, although, it doesn’t work perfectly in every instance. 

Senator Dodd. How many complaints does the FTC get a month, 
roughly, of this kind? 

Mr. Beales. I do not have a specific number. We get probably — 
well, this is probably annual. We probably get several thousand 
complaints about each of the three credit bureaus. 

Senator Dodd. On a monthly basis? 

Mr. Beales. That is probably annual. 

Senator Dodd. Several thousand. 

Mr. Beales. Yes. 

Senator Dodd. What categories do they fall into, roughly speak- 
ing? Identity theft? Credit card? Inaccuracies? 

Mr. Beales. Those are accuracy complaints. 

What you have to understand in thinking about the accuracy 
complaints that we get, and we do not have any independent as- 
sessment of whether the information is really accurate about who’s 
right in this dispute. We know there is a dispute. 

And we do know because we get complaints from them, that 
there are some consumers who do not understand the way the sys- 
tem works. They think that if they were behind on their payments 
and that was reported, but they are now current, that the fact that 
they were behind should go away. 

But that is not inaccurate. They were, in fact, behind. That infor- 
mation is part of the credit report, and stays there, but it some- 
times leads to disputes because consumers do not understand that 
that is the way the system works, and is designed to work. 

Senator Dodd. Is there a breakdown between credit furnishers 
and the reporting agencies themselves? Do you see any evidence of 
that? 

Mr. Beales. We have been very interested in what the fur- 
nishers are doing. We have brought the first furnisher cases that 
are based on furnisher liability, in order to assure that furnishers 
are providing accurate information. 

Where we, frankly, have seen the most difficulties is with the in- 
formation reported by debt collectors, rather than the information 
reported by other kinds of creditors. 

But we are quite interested in furnisher issues across the board 
as an enforcement priority. 

Senator Dodd. And you say that you have had a chance to look 
at those articles in the Hartford Courant. 

What is your reaction to them? 

Mr. Beales. The potential consequences of mistakes in credit re- 
ports are very severe. I think that is why this statute is important 
and why the set of statutory protections to correct mistakes is very 
important. 
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It is why we have made the enforcement of those mechanisms, 
hoth furnisher liability and of the adverse action notices, why we 
have made those key priorities in our FCRA enforcement efforts. 

I think that is the main point, that the accuracy is really a crit- 
ical issues. 

Senator Dodd. I appreciate that. I might, Mr. Chairman ask if 
maybe we could get some numbers, if you could. I would just be 
curious about the number of complaints you get and if you could 
give a little more accurate breakdown of what categories they’d fall, 
it might be helpful to the Committee. 

Mr. Beales. Sure. We would be happy to do that. 

Chairman Shelby. I think that is an excellent suggestion. 

Senator Dodd. Thank you. 

Thank you very much, Mr. Chairman. 

Chairman Shelby. Senator Stabenow. 

STATEMENT OF SENATOR DEBBIE STABENOW 

Senator Stabenow. Thank you, Mr. Chairman. 

First, I do have an opening statement that I would appreciate be 
made a part of the record. 

Chairman Shelby. It will be made a part of the record in its en- 
tirety, without objection. 

Senator Stabenow. Thank you very much for holding this hear- 
ing. And thank you, Mr. Beales. It is an important topic. 

I wonder if I might just follow up on the questions as it relates 
to consumers. Earlier, Senator Banning was asking you for the toll- 
free number. 

I am wondering, that really leads me to a question concerning 
the opt out provisions. And we know, for every prescreened credit 
offer, there has to be a notice of the consumer’s right to opt out. 

Could you speak a little bit about how that is working? Do people 
understand it? Do others, other than Senators, not know the toll- 
free number? 

I did not know it, either. 

But, also, do they understand how to do it correctly? How is this 
working, overall? 

Mr. Beales. We do not have any systematic assessment of how 
many consumers know or do not know. Or how much they know 
about exactly how to go about it. 

There are disclosures that are supposed to be provided with 
every prescreened offer that you get of how to do it and what num- 
ber to call. But there is a lot of information there, and a lot of other 
information about the offer and the terms of the offer that probably 
makes it hard to find in a great many circumstances. 

It is not something where we get a lot of complaints, I do not be- 
lieve. From that perspective, the system seems to be working. 

But I am sure there are consumers who do not know that they 
can opt out, some of whom may prefer to opt out. 

Senator Stabenow. And what percentage of consumers are opt- 
ing out? 

Mr. Beales. That I do not know. 

Senator Stabenow. So, you do not have any way of tracking this 
point, how many opt out, what percentage? 
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Mr. Beales. The system is maintained by the three credit bu- 
reaus and they would be able to tell you how many people have in 
fact opted out, I mean, how many people are on the list. 

But we do not have that information. 

Senator Stabenow. Okay. And would you make any changes 
from your perspective in how that is working, that whole process 
for consumers? 

Mr. Beales. As I say, the Commission doesn’t have legislative 
recommendations at this time. I do not think we have seen any- 
thing that has seemed to us to be a particular problem in that 
area, that really needs to be fixed. 

Senator Stabenow. Okay. Thank you very much. 

Chairman Shelby. Thank you. Senator. 

I want to go back to the issue of credit report accuracy. 

Is there an acceptable tolerance level for errors, and what is that, 
if there is? In a risk-based system, there has to be some tolerance, 
but what is the threshold? 

Mr. Beales. The statutory standard focuses on procedures, rea- 
sonable procedures to assure the maximum possible accuracy. 

It doesn’t set a numerical threshold. Even if the error rate is 
very low, if it is cheap to fix, you should fix it. But if it is really 
difficult to fix or really expensive to fix, if there is no reasonable 
way to correct it, or no reasonable procedure that would prevent it, 
then that would be acceptable under the statutory standard. 

But it is not a numerical threshold. It is a balance of 

Chairman Shelby. How would you — excuse me a minute. You 
said if there is no reasonable way to fix it. But what if it were so 
prevalent, it called for fixing? 

I am not saying it is, but you said if there is no reasonable way 
to fix it. First of all, assuming that the number of errors are small, 
we understand that. 

Mr. Beales. Let me back up because I think what I should have 
said is, there is no reasonable way to prevent it. 

Chairman Shelby. Okay. 

Mr. Beales. Because if there is an error and it is called to your 
attention, you have to fix it. 

Period. End of story. 

Chairman Shelby. That is correct. 

Because accuracy is important. 

Mr. Beales. Because accuracy is important. Absolutely. 

Chairman Shelby. Right. 

Mr. Beales. But the reasonable procedures focus on what kinds 
of steps can you put in place to keep that from happening in the 
first place? 

Chairman Shelby. Is there any way to gauge what is or should 
be an acceptable error rate? You said that they do not do it statis- 
tically. 

In other words, you do not do it numerically. You do not say that 
the error rate is — I am just throwing this out there — 3 percent or 
5 percent or one-half of 1 percent or one-hundredth of 1 percent. 

Is that what you were saying a minute ago, that you do not 
gauge that? 

Mr. Beales. There is no bright-line standard in the statute of 
what is acceptable. Even if the error rate was a hundredth of a per- 
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cent, if you could avoid that for free, then under the statute, you 
have to do that. 

It is a question of what kinds of costs do you have to incur, what 
is reasonable to do to avoid that particular error. 

Chairman Shelby. I think Senator Dodd asked you the question 
of, something to the effect, how many complaints did you have at 
the Federal Trade Commission a year? And you said, around 2,000, 
more or less, on a yearly basis. 

Mr. Beales. Per credit bureau. 

Chairman Shelby. Per credit bureau. Six thousand? Three credit 
bureaus? 

Mr. Beales. I think it is probably a bigger number than that. 

Chairman Shelby. A larger number. 

Mr. Beales. Let us get you the precise number. 

Chairman Shelby. Can you furnish that for the record because 
we are building on it. 

Mr. Beales. Yes, sir. 

Chairman Shelby. What are the considerations or trade-offs in- 
volved in the calculation of an acceptable rate of error? 

For example, maintaining as much participation as possible with- 
in a voluntary furnisher system versus accurate record of consumer 
credit history, and ultimately, the appropriate pricing of credit. 

Accuracy goes to the very heart of all of this. And it would seem 
to me that not only would the credit bureau, or whatever, but also 
the credit-checker, would want their reports to be accurate. 

The user of that information — let’s say it is a mortgage company 
or a bank or something — they would certainly want it to be accu- 
rate, wouldn’t they? 

Mr. Beales. They certainly would. I think everybody in the sys- 
tem, consumers, users, credit bureaus, benefits from accuracy. 

I think that is absolutely right. 

Chairman Shelby. Benefits from accuracy, starting with the con- 
sumer on. 

Risk-based credit pricing — I think Senator Sarbanes alluded to 
that earlier. I think that we all recognize the many positive, and 
there are many, developments associated with technological ad- 
vancement. 

Technology has made our credit markets remarkably responsive 
to consumer demand, as Senator Bennett would have shown us 
with a bigger chart, right? 

[Laughter.] 

Senator Bennett. Right. Colored chart. 

Chairman Shelby. Yes, a larger chart. That said, just to get a 
handle on just where technology has taken our credit markets, 
could you explain or expand a little on the use of risk-based pricing 
and how much more prevalent its use today versus 1996 and 1971, 
if you could? 

Mr. Beales. I cannot do it in a quantitative way, but clearly, 
qualitatively, there has been substantial change. I think particu- 
larly in 1970, at the time the statute was first passed, the domi- 
nant model and the way most credit decisions were made was you 
applied for credit that was available on a fixed set of terms and you 
were either approved or denied on that same fixed set of terms. 
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I think probably the predominant model today is you apply for 
credit. The terms — sometimes you are accepted or rejected. But 
with growing frequency, the terms you are offered, whether it is 
the interest rate or the credit limit or some other aspect of the 
credit arrangement, depend on the risk that that individual bor- 
rower presents. 

And the higher the risk, the worse the terms. 

Chairman Shelby. Sure. 

Mr. Beales. That is a much more common model today than it 
was. Certainly in 1970, the information-processing technology and 
the information-sharing technology simply wasn’t in place to sup- 
port that kind of system on any very large scale. 

Now it is. Now it is done. It is much more differentiated pricing 
of credit and insurance products based on the risks that a par- 
ticular consumer may pose. 

Chairman Shelby. I think the use of risk-based pricing offers 
numerous benefits to consumers. You alluded to that. Credit is now 
offered to many people who were previously deemed unqualified. 
Hence, his chart a minute ago, I think. 

And credit pricing is much more tailored now to each individual, 
more so than it used to be. 

Would that be a fair assessment. 

Mr. Beales. I think that is correct, yes. 

Chairman Shelby. But the use of risk-based pricing also raises 
issues about the continued effectiveness of some aspects of the Fair 
Credit Reporting Act. 

You mentioned, if you want to refer to your written testimony, 
how accuracy, and I will quote:“Was, and remains a core goal of the 
Fair Credit Reporting Act.” 

You then indicate and I will quote :“Adverse action notices. . .are 
a key mechanism for maintaining accuracy.” 

With the use of risk-based scoring, however, a consumer may 
qualify for credit, but not at the best terms. 

By not making an outright rejection, creditors as I understand 
the system — do not have to send an adverse action notice and cred- 
it applicants may then never become aware of the need to examine 
their credit reports. 

Does this cause you any concern about the continuing relevance 
of the adverse action process? 

For example — let me see if I understand it. 

Let’s say they check my credit and I do not have A number one 
credit like Senator Bennett’s father or like he would have liked to 
have had. Right? And they come back and instead of telling me 
that, they say, we will offer you something based on the risk. 

Is that the way they do that? The credit risk as they perceive my 
credit, rather than an outright rejection. 

Mr. Beales. Yes. And that is a counter-offer. 

Chairman Shelby. Yes, it is a counter-offer. Explain how that 
works. That avoids the necessity of the adverse 

Mr. Beales. It depends on what you do with it at that point. 

Chairman Shelby. Sure. 

Mr. Beales. If you reject the counter-offer, then that is adverse 
action. 

Chairman Shelby. That is right. 
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Mr. Beales. And if it is based, in part, on a credit report, they 
have to tell you. 

Chairman Shelby. Sure. 

Mr. Beales. If you accept the counter-offer, then, because ad- 
verse action is tied to the definition of adverse action under the 
Equal Credit Opportunity Act, then there is no adverse action be- 
cause you got the credit that you wanted. 

Chairman Shelby. You got the credit maybe not that you ini- 
tially wanted, but you got a deal and took it. 

Right? 

Mr. Beales. That is right. I think that raises a difficult trade- 
off. We are thinking about the issue, but we do not have a rec- 
ommendation. 

Chairman Shelby. Tell us how you are thinking about it. 

Mr. Beales. Yes, sir. 

Chairman Shelby. Just for the record. 

Mr. Beales. On one hand, if you are not getting the best terms, 
and that is based on the credit report, you need to get notice. 

Chairman Shelby. Maybe I wouldn’t deserve the best terms. 

Mr. Beales. That is right. You may not get the best terms based 
on accurate information rather than inaccurate information. 

But if it is based on inaccurate information, you need the notice 
to trigger your right to look at the file. 

But in a pure, risk-based system, where the best person out 
there gets the best price, and everybody else gets somewhat worse 
terms — if you think of it at that extreme 

Chairman Shelby. But everything’s a risk. It should be based — 
if it is based on risk, somebody’s more creditworthy and has 
worked hard, diligently to pay their bills, as opposed to, say I 
hadn’t, they should be rewarded, should they not? 

Mr. Beales. They should. I agree with that completely. 

Chairman Shelby. Because they are less of a risk, say, than I 
would be. 

Mr. Beales. I agree with that completely. But if you say, well, 
giving less than the best terms is in some sense an adverse action, 
and we have said that about insurance where there is not the link- 
age — if you get insurance on less than the best terms, we have said 
that is adverse action and you have to give notice. 

But in a completely risk-based system, that means everybody 
gets notice all the time, except the best risk. And that degrades the 
notice because it no longer serves the function of saying, there may 
be something unusual here, which it does now, and it does under 
the present system. 

And there is a balance between giving notice when people need 
it and not overwhelming people with notices that say there might 
be something in your credit report, because you could say that to 
everybody all the time. 

Chairman Shelby. Sure. But going back to what I mentioned, 
and you mentioned in your testimony earlier, risk must be gauged 
accurately, as best we can. 

Mr. Beales. Certainly. 

Chairman Shelby. That is what the system is about, is not it? 

Mr. Beales. Certainly. 
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Chairman Shelby. Is gauging the risk as accurately — and you 
gauge it accurately based on the information that you pull up, do 
not you? 

Mr. Beales. That is right. 

Chairman Shelby. Or should. 

Mr. Beales. That is why the availability of information is impor- 
tant and it is why the accuracy of the information that is provided 
is important, because it gives you a better gauge of what the risk 
really is. 

Chairman Shelby. Are there more or less adverse action notices 
now than before? 

In other words, are there more counter-offers? 

Mr. Beales, there is offsetting influences. I think there is more 
counter-offers that are accepted and that would push it down. But 
there is more credit, and that would mean more denials. 

Chairman Shelby. Can you furnish that information for the 
record to the Committee? 

Mr. Beales. I doubt if we have it. But if we know, we will be 
happy to furnish it for the record. We will see if we have it. 

Senator Bennett. Than before what? 

Chairman Shelby. We are talking about before, let’s say, 1971. 
Let’s say 1996, the 1996 Amendments. 

The timeframe. Before the 1996. 

Senator Bennett. No. I want to see the benchmark. 

Chairman Shelby. I amended my question. 

Before 1996 and after 1996. 

Mr. Beales. Okay. My suspicion is that we do not have any in- 
formation to answer that question. But we will look, and if we do, 
we will certainly provide it. 

Chairman Shelby. The use of risk-based pricing is what we are 
getting at. 

Technology has made it much easier to transfer, as we all know, 
massive amounts of information and data, thereby increasing the 
capability of credit reporting systems in many ways. 

We benefit from that. 

Can you comment on whether or not technology has enhanced 
the overall accuracy of credit reports? And do you have anything 
at the FTC — have you done a study on that? 

Mr. Beales. We have not done a study on that. 

Chairman Shelby. It should be more accurate, shouldn’t it? 

Mr. Beales. I think technology has clearly enhanced the speed 
of the reinvestigation process. It is made it possible to reinves- 
tigate, I mean, just the automated information exchange. 

Chairman Shelby. It is the reaction to something. 

Mr. Beales. Yes, yes. But the technology has made possible 
automated information exchange both to get the information, to re- 
port back to the furnisher that there is a dispute, and then for the 
furnisher to report back the truth. 

That can all happen much quicker than it used to. 

We do not know of any objective measure of how accurate the in- 
formation is in credit reports that would be available over time to 
say firmly whether it is more or less accurate, what is actually 
been the trend in accuracy. 

Chairman Shelby. Senator Sarbanes. 
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Senator Sarbanes. I will be very brief. I just want to make sure 
that I understand the statutory framework that we are dealing 
with here. 

As I understand it, under FCRA, most State credit reporting 
laws are not preempted unless there is a specific inconsistency be- 
tween the FCRA and the State law. And that we have also enumer- 
ated certain exceptions in which there is a preemption of any State 
law differing with the Federal provision. 

Is that correct? 

Mr. Beales. Yes, sir. 

Senator Sarbanes. Okay. Now, if the preemption were allowed 
to expire, you testified earlier that you might anticipate that States 
might act in one or another of these areas in which they heretofore 
have been preempted. 

Presumably, if you were asked, you could indicate the areas that 
you thought were most likely in which State action might take 
place if they weren’t blocked out from doing so because of the pre- 
emption requirements. 

Would that be the case? 

Mr. Beales. One could look — there is an analysis like this that 
has been done that I am not familiar with the details of 

One could look at the kinds of proposals that have been made in 
State legislatures and get some sense of where the States might be 
active and where they might not. 

Senator Sarbanes. Who did that analysis to which you made ref- 
erence? 

Mr. Beales. It was done by the Information Policy Institute. 
This is the study that is ongoing on the effects of losing different 
kinds of information from the credit reporting system. 

Senator Sarbanes. Could you provide that study to us? 

Mr. Beales. It is not complete yet. I believe their intention is to 
provide it to you as soon as it is complete. 

Senator Sarbanes. And one could take this list of what might be 
anticipated if there were not preemption and look it over and make 
some judgment as to which of those possible actions seem to be 
worthy in terms of protecting the consumer interest. 

And those standards could be incorporated into the Federal law, 
could they not? 

Mr. Beales. Certainly. Certainly. 

Senator Sarbanes. That would maintain a national uniform sys- 
tem with respect to credit, so you would not have this fractionating 
that people are talking about, but would, in effect, constitute a re- 
examination of the preemption areas in terms of making a judg- 
ment whether we were fully keeping ahead of what needed to be 
done to provide reasonable consumer protection. 

Could we not engage in such a process? 

Mr. Beales. You certainly could. 

Senator Sarbanes. Does the FTC have any plans to do so? 

Mr. Beales. We have had an ongoing process of trying to look 
at what kinds of changes might make sense, where balances might 
be struck differently. 

And at this point, the staff has not made any recommendations 
to the Commission and the Commission doesn’t have any rec- 
ommendations. 
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But it is something that we are very interested in. It certainly 
is an alternative to change nothing, is to strike a slightly different 
but still uniform national balance between the conflicting interests. 

Senator Sarbanes. This supposed conflict between the consumer 
protection, particularly responding to new and changed circum- 
stances, and a uniform national market, need not be any conflict 
at all if the consumer protection is provided to a national standard. 

Would that be correct? 

Mr. Beales. I think if it is done uniformly by Congress, and pre- 
emptively, so that it is not subject to another round of changes that 
States would make subsequently, then, clearly, that would preserve 
the uniform market and the question would be, is that particular 
change a good change or not? 

Senator Sarbanes. Yes, the reasonableness of the change. 

Mr. Beales. Right. 

Senator Sarbanes. But that would get you away from this, it 
seems to me, some effort that is being made as though we only 
have a Hobson’s choice here. 

Chairman Shelby. Right. Exactly. 

Senator Sarbanes. Between fractionating the uniform market or 
addressing some of the problems that consumers are encountering, 
which, upon a reasonable examination, one could conclude some- 
thing needs to be done about them. And that would be a way of 
doing something about them and sustaining the uniform national 
market. 

Is that not the case? 

Mr. Beales. That is the case. For Congress to make a different 
but uniform change would certainly do that. 

Senator Sarbanes. Thank you very much, Mr. Chairman. 

Chairman Shelby. Senator Bennett. 

Senator Bennett. Thank you. Mr. Beales, I do not quite under- 
stand the market for the services of the three providers. 

There are now only three credit bureaus that you go to? 

Mr. Beales. There are three large repositories. There are hun- 
dreds of credit bureaus. Most of them are small credit bureaus for 
purposes of the Act. Most of them are small and local or specialized 
in some particular market in some way. 

But there are three that qualify under the Act as, “national cred- 
it bureaus.” 

Senator Bennett. So as far as we are concerned, there are really 
only three. 

Mr. Beales. For most purposes, that is right. 

Senator Bennett. You do not oversee the others. 

Mr. Beales. We do. 

Senator Bennett. Oh, you do. 

Mr. Beales. We do. And we have brought cases involving some 
of the others. Resellers, for example, are regulated as credit bu- 
reaus. 

I think, in thinking about the statute, it is important to remem- 
ber that there are all the others because sometimes things that 
would make sense for the big three wouldn’t work at all for some 
of the other people. 

And that is why they are important. 
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Senator Bennett. That is very helpful. And I hadn’t understood 
that before. 

Can you provide us for the record with a breakdown of volume 
between the big three, if we can call them that, and then all of 
these others? 

What percentage of the volume of credit reporting is involved 
with the others, if you have it off the top of your head? If not, you 
can provide it. 

Mr. Beales. I do not. We will look and see if we can provide it. 

If it we can provide it, it will be from industry data and not from 
anything we know. 

Senator Bennett. Okay. 

Mr. Beales. But we would be happy to look and see whether 

Senator Bennett. What would you be surprised if it were more 
than? 

Mr. Beales. I do not know if there is a more than that would 
surprise me. 

[Laughter.] 

In terms of volume, it clearly is dominated by the big three. 

Senator Bennett. Okay. 

Mr. Beales. The others are specialized and important in their 
own way, but they are small players in the overall market. 

Senator Bennett. Okay. Let’s deal with those three, then. 

All right. I am a retailer. In addition to taking Visa cards and 
MasterCard and Discover card and all of these others who have 
taken a lot of the burden of my credit operation away from me, I 
nonetheless maintain an in-house credit operation. I offer credit to 
my customers. 

On what basis would I make a choice between the three? Is 
there, indeed, viable competition between them? And does that 
competition — to tell you where I am going — does that competition 
drive them, each one, to be more accurate than the other two, more 
responsive than the other two, prettier reports, fancier colors? 
What is the competition between the three of them? 

Mr. Beales. I think the competition is mostly about the breadth 
and depth of the information that they can provide, that it is based 
on — and different bureaus have made different choices about where 
they try hardest to build relationships with furnishers, who are ul- 
timately the source of data. 

One bureau may have stronger relationships in one geographic 
area than in another and a different bureau may have adopted a 
different competitive strategy. 

Senator Bennett. Is there any evidence of users switching from 
one to the other, deciding that the services from credit reporting 
agency A somehow do not meet my needs as well? Are there sales- 
men calling on users to say, switch to my brand? 

Again, what I am driving toward is that if there is, indeed, a 
market competition here, it is going to drive each one to be as accu- 
rate as possible because the worst thing you could do, it would 
seem to me, would be to be in the business of reporting credit infor- 
mation and be wrong and thus lose customers. 

Now, do, in fact, customers shift and move from one to the other? 

Mr. Beales. I think customers do shift and move. I think there 
is competition in this market in a very effective way. I think there 
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are market incentives for accuracy and the competitive pressures 
are part of it. 

However, I also think creditors care much more about some 
kinds of mistakes than others. They really do not want to miss bad 
information because, if they do, then they are going to get burned 
with losses. 

It matters less to the creditors who are buying the reports if they 
are missing good information about you because they are not going 
to suffer losses in the same magnitude. 

So, I think there is a role for Federal oversight, for regulatory 
oversight of accuracy. But I think there are also important market 
incentives to keep the information as accurate as possible. 

Senator Bennett. Okay. Thank you very much. I am a great be- 
liever in the market and the power of the market. And I think that 
may be a greater policeman — I am going to lose this user if I do 
not do a good job — than, gee, I have to check with my lawyer to 
make sure that I am complying with every one of the regulations 
out of the FTC. 

Chairman Shelby. Senator Schumer. 

STATEMENT OF SENATOR CHARLES E. SCHUMER 

Senator Schumer. Thank you, Mr. Chairman. I want to thank 
you for holding these hearings. You have been involved in this 
issue a long time. 

Back in 1995, I guess, you and Senator Bond, the bill that you 
sponsored, set the stage for all of this. And I thank you for that. 

This area seems dull to people. But the bottom line is that prob- 
ably the credit markets have more effect on people than the equity 
markets, even though we spend a lot more time on the equity mar- 
kets around here. 

So, I think it is an important hearing and we have to be really 
careful about it. 

Just to make a point, I think it would be really bad to frac- 
tionalize these markets. We all know that. There should be a na- 
tional market. 

My view, an attempt to make it better, that risks fractionalizing 
them, and you have to be real careful. But that doesn’t mean that, 
as you keep the markets national, you cannot improve a bit of reg- 
ulation. 

I do not think we have that much variation here, although I 
would warn my colleagues, in an attempt to open up, to move into 
new areas, if we risk not keeping this Act intact, we run a real 
danger. 

I take it that you would agree with that. 

Mr. Beales. The Commission hasn’t taken a position on preemp- 
tion or not. I think the risks of fractionalization are very real. 

Senator Schumer. What would outweigh them in a national 
credit market, other than the fact that the Commission hasn’t 
taken a position? 

[Laughter.] 

Mr. Beales. I think there are benefits from State experimen- 
tation, if you will, in different approaches that may work better in 
some particulars. And I think that is the trade-off. 
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And as I say, the staff hasn’t made a recommendation. The Com- 
mission hasn’t taken a position on how we think that balance 
should be struck at this point. 

Senator Schumer. And do you think the two are irreconcilable, 
that you cannot have a national law and still allow some State ex- 
perimentation? 

Mr. Beales, no, I do not think they are irreconcilable. And I 
think the existing statute allows State experimentation in many 
areas. But not in some. 

Senator Schumer. And are there any that come to mind where 
we should allow experimentation where we do not now? 

Mr. Beales. Among the existing preemptions? 

Senator Schumer. Yes. 

Mr. Beales. No, there is none in particular I would single out. 

Senator Schumer. Good. You also, I guess, and this relates to 
the question I was asking — I think you would agree — well, let’s 
quote Chairman Greenspan, somebody I have a lot of respect for. 

He says: 

Limits on the flow of information among financial market participants or in- 
creased costs resulting from restrictions that differ based on geography, may lead 
to an increase in price or a reduction in the availability of credit, as well as a reduc- 
tion in the optimal sharing of risk and reward. 

As a result, I would support making permanent the provision currently in the 
Fair Credit Reporting Act that provides for uniform Federal rules governing various 
matters covered by the FCRA and would not support allowing different State laws 
in this area. 

Now, as a careful student of Greenspan-speak, on that one, there 
is not a lot of Paul Volcker cigar smoke floating around. 

[Laughter.] 

He’s pretty clear. Do you — again, I am not asking you to the out- 
come here, given the constraints of the Commission. But do you 
share his concern that limits on information flow could, “Lead to 
an increase in price or a reduction in the availability of credit?” 

Mr. Beales. That is certainly the risk. The Commission’s testi- 
mony quotes Chairman Greenspan saying essentially that, minus 
the conclusion. 

I think we agree that that is the risk. That is what is at stake 
here. 

Senator Schumer. Okay. Let me ask you about two specific 
issues that I care about, that we might, as we look forward on 
FCRA, want to involve ourselves with. I, at least, will be careful 
about the admonition that we do not want to let this whole deal 
lapse. 

Identity theft. On this one, I have been very concerned with iden- 
tity theft. We have had a lot of problems in my State with it. 

But you can look at the glass being half full or half empty in 
terms of FCRA as it relates to identity theft. Some would say that 
our credit reporting system makes it easy to steal identities. And 
others would say that the system makes it easier to detect, catch, 
and remedy identity theft. 

Do you have a view on that? 

Mr. Beales. I think there is important senses in which they are 
both right. 
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I think the regulatory approach that the FCRA strikes is, I 
think, exactly the right approach that we need to take to think 
about identity theft. 

We need to be able to share this information. It is important in 
many areas. But we need to try to restrict the uses to which that 
information is put. 

The problem of identity theft is the wrong people get information 
and use it for the wrong purposes. But, I think that the need to 
share that information for legitimate purposes, including to prevent 
and detect identity theft, is crucial. 

Senator Schumer. Okay. And what about on making more trans- 
parent the credit score? 

Senator Allard and I, in the last Congress, introduced legislation 
to do this. It was supported by lots of the lenders, and we are plan- 
ning to do it again. So that if a mistake is made on your credit 
score or something is wrong with it, that you get to see it, can get 
to challenge it, like we do in so many other areas. 

What is your view on that kind of improving, in my judgment, 
that would improve legislation to allow people to see what goes into 
their credit score? 

Right now, they have no way of even knowing if there is a mis- 
take. It befuddles lots of people, and lots of lenders. 

Mr. Beales. I think the key is the accuracy of the underlying in- 
formation because the algorithm that converts the information in 
your file into a score is essentially a little bit of computer code that 
does what it is going to do and weighs the different information ap- 
propriately. 

Senator Schumer. Sure. 

Mr. Beales. And consumers can look at the information that is 
the basis for that and correct the inaccuracies at that level. And 
that, in fact, is ultimately what they have to do. 

Whether they know the score or not, whether or not they know 
the algorithm or not, the only way to fix it is to correct the mistake 
in the underlying information that gave rise to the erroneous score. 

I think what is hard about more information about scores is 
scores are different. You may have different scores for different 
creditors and provided in different ways. 

Senator Schumer. Different scores sometimes for the same cred- 
itor, too. 

Mr. Beales. Perhaps. 

Senator Schumer. For different groups. 

Mr. Beales. For different models or different groups, absolutely. 

Senator Schumer. But the system really is not working well 
now, I do not think. 

Do you think it is? Do you think consumers right now, under the 
present system, really have the ability to correct errors, unless they 
spend a whole lot of time and effort on it and it is beyond their 
ken? 

Mr. Beales. I believe there is some difficulty in correcting errors. 
It is not the easiest thing in the world to do. I think that is right. 

I think it is a system that, as best we can tell, mostly works. It 
doesn’t work perfectly all the time. The mechanisms to provide and 
assure accuracy we think are really important. And we have 
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worked very hard on the enforcement side to try to make sure that 
they are in place and followed. 

Senator Schumer. Okay. I had one more question, Mr. Chairman 
I am trying to find it here. 

[Pause.] 

Oh, yes. One of the great debates we have always had in this 
Committee is privacy rights, which again is a lot easier to talk 
about in the abstract. And when you get into the specifics and see 
the push and pull, I do not think it is as clear and as easy. 

But it has been a great concern, I know, to the Chairman and 
to me. We had this debate on Gramm-Leach-Bliley. 

And so, my final question to you is, should we, do you think, ad- 
dress larger issues in a reauthorization of FCRA, like identity 
theft, which I mentioned, but privacy in particular? 

Or should we not? 

You know, we could say, Gramm-Leach-Bliley is new. We struck 
a balance there. Let’s not go into other areas or let’s not change 
what we have done. 

Mr. Beales. We have always thought that the FCRA is fun- 
damentally a privacy statute. And in that sense, you cannot avoid 
addressing those parts of privacy because that is what the FCRA 
is all about. That is one of its key objectives. 

I think, frankly, that that part of privacy is complicated enough, 
that it will likely keep you very busy in trying to figure out what 
is the best answer here. 

There are some parts and some of the identity theft issues may 
be like this, that are so intimately related to the FCRA, that they 
should be part of that process. 

But from my own perspective, the more it can be kept confined, 
the easier it is to deal with. And it is hard enough to deal with as 
it is. 

Senator Schumer. Do you know if the Administration has a view 
on this? This is a key national issue and it is hard to figure out 
what they think in terms of FCRA and privacy. 

Mr. Beales. I do not believe that the Administration has taken 
a position as yet. 

Senator Schumer. Do you think they ever will? 

Mr. Beales. Yes, I think they will. 

Senator Schumer. Okay. Good. 

Thank you, Mr. Chairman. 

Chairman Shelby. Thank you. What is your sense as to the gen- 
eral level of public awareness with regard to things like the content 
of credit reports? 

This is picking up a little on what Senator Schumer was into. 

In other words, you are the average person in America. What is 
your general awareness regarding the content of their credit re- 
port? 

Mr. Beales. I think it is something that most people probably 
never think about. I think if you ask them questions, most people 
would have a reasonable sense of some of the core elements, that 
their payment history is in there. 

Chairman Shelby. If they do not, they should. 

Mr. Beales. If they do not, they should. We have a wide variety 
of consumer educational materials to try to enhance consumers’ un- 
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derstanding of what is there and why it matters. But we do not 
have any measures of what they actually know. 

Chairman Shelby. How can you disseminate information to the 
consumer — that is all of us, not just in this room, but all of us — 
to let us understand what credit scores are and how they are used? 

You have a computer model out there to rate all of this. This is 
risk-based credit-scoring, in a way. 

Right? 

Mr. Beales. Yes, it is. 

Chairman Shelby. You have a risk-based system. And the more 
the consumer knows about how they are being rated, even if it is 
complicated, the better off they’d be, wouldn’t they, in the long run? 

The more information a consumer knows about things that are 
rated that affects their lives, their credit and so forth. 

Mr. Beales. In general, I certainly think that is right. I mean, 
I think the complication in credit-scoring kinds of models in par- 
ticular is — you do not want consumers to be able to play games 
with the system. 

Chairman Shelby. Absolutely. 

Mr. Beales. That would affect the validity of the underlying 
model. 

Chairman Shelby. I am not talking about playing games. I am 
talking about just being aware. 

Senator Schumer. Mr. Chairman. 

Chairman Shelby. Yes, sir. 

Senator Schumer. I just want to back him up. From what I am 
told, some credit scores, if you have 10 credit cards, even though 
you paid each one, you will end up with a different credit score 
than if you have two. 

Why shouldn’t the consumer know that and let it go in? Yes, 
when you ask consumers or even the people representing them, 
why they got the following credit score, nobody has any idea. 

Sure, you can get all your data about everything, but you do not 
know what went into it or where there might be a mistake and 
where there is not. 

I am glad you brought it up, Mr. Chairman. 

Chairman Shelby. The scoring. Senator Schumer, as you well 
know, affects millions and millions of Americans’ credit. 

Senator Schumer. Yes. 

Chairman Shelby. And I would say the average American, for 
lack of better information on my part, has no clue as to how their 
credit is rated, based on this computer model. 

Senator Schumer. And they cannot get it. 

Chairman Shelby. And they cannot get it. 

Senator Schumer. That is the bill that Senator Allard and I are 
trying 

Chairman Shelby. That is what we are both talking about. 

Mr. Beales. Yes, I understand that. And I think there have been 
a variety of changes in the industry to try to provide consumers 
with more information about what goes into that score in a big-pic- 
ture sense and how it is computed and why it matters. 

We certainly have consumer education that tries to do the same 
thing. 
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But I think, as you point out, the specifics of what goes into a 
score depends on which score you are talking about because dif- 
ferent people use different models. 

Chairman Shelby. That is exactly the point he was making. 

Mr. Beales. That look at different information. 

Chairman Shelby. Do the three credit, the big credit houses, do 
they score — do they have a different model to score? 

Mr. Beales. There is an industry leader. Fair Issacs, that pro- 
duces the FICO score. That is probably what most people think of 
as credit scores. 

Both users and I believe, I am not sure to what extent, but both 
users and some credit bureaus have their own proprietary scoring 
models that do things a little differently that they think give a bet- 
ter perspective on risk. 

Chairman Shelby. But it depends. If a consumer depends on 
what credit house that evaluated their credit, depends on how their 
credit is rated, perhaps, based on the model of assessing their risk? 

Mr. Beales, people differ — I mean, creditors differ. And the ex- 
tent to which they use just the score, there are creditors who build 
their business around what they think is their ability to differen- 
tiate the risks they face and the risks that customers pose more 
finely than the standard scoring model. 

Chairman Shelby. That is underwriting, is not it, to a certain 
extent. You are evaluating this risk here based on the credit, based 
on, say if there is a property or something, a mortgage, location of 
the property, everything that goes with it, the appraisal of the 
property. 

Mr. Beales. In a sense, it is underwriting. It is also the initial 
credit decision. 

Chairman Shelby. Yes. 

Mr. Beales. And to take a group of consumers — and there are 
powerful competitive incentives to do this — but to take a group of 
consumers who may have the same credit score and to try and 
spread them out in terms of those consumers, which ones are the 
higher risk and which ones are the lower risk. 

So it is really difficult to talk about. Your payment history at this 
store over this period of time is an objective fact that doesn’t 
change. And we can make sure that that is accurate in the credit 
report, and we can. 

But your credit score depends on the model, depends on the cred- 
itor, and it depends on the underlying information. 

I agree consumers should understand much more about how it 
is done. But it is much more complicated to try to explain and to 
try to verify than the straightforward fact about a particular piece 
of paper. 

Chairman Shelby. Should we have some type of uniform model 
adopted in the industry or industry-wide, rather than two or three 
different ones that bring different results? 

Mr. Beales. I think not. I mean that would, in essence, be regu- 
lating the degree of credit risk that different lenders can take on. 

Senator Schumer. But 

Chairman Shelby. Go ahead. Senator. 
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Senator Schumer. Thank you. I would agree with you that we 
shouldn’t say what model. That is competition. But I do not see 
why it shouldn’t he transparent how the score came out. 

My experience is, and you have said something a little contradic- 
tory, so maybe I do not understand it well enough. I apply for a 
mortgage. My neighbor applies for a mortgage. And I just happen 
to know that I did not get it because my credit score wasn’t good 
enough, and he did. We live on the same street in, let’s say, Levit- 
town, identical house. And I go over my mistakes in my credit his- 
tory and I ask him, and it seems the same. And there is no way 
to really find out why I got lower than him and what I could do 
to correct it. 

And I go a step further. I also think that if a mistake was made, 
like they say I missed a payment, but it was Jon Smith, not John 
Smith, that there is virtually no way that I can figure that out un- 
less I have more information than the law allows me to. 

Am I wrong about that? 

Mr. Beales. I think you can figure out the payment because you 
know, and presumably, can verify from your own records, hey, wait 
a minute. I wasn’t late. I made my mortgage payment on time, or 
I made that payment on time. 

Senator Schumer. The credit company, if they are using the last 
5 years of mortgage payments and not the last ten, will tell me? 

At least my experience with this is it is a little more complicated 
than you are making it out. 

Yes, I know I did not miss a payment in 1992. But I do not know 
if that is part of the formula and my credit score thinks I did. 

Mr. Beales. Okay. 

Senator Schumer. Follow me? 

Mr. Beales. I guess what I am saying is, if you have the pay- 
ment history right, if the payment history shows up in the credit 
report correctly, and that information is all accurate and you know 
whether that information is accurate or not, then I do not think we 
have ever heard of a case where the numerical calculation to con- 
vert that information to a score had an error in it. 

Computers are pretty good at arithmetic. 

Senator Schumer. No, no, that is not what I am saying. 

Mr. Beales. The problems are the accuracy of the underlying 
data. 

Senator Schumer. Yes, and there is no way of you knowing 
whether that underlying data is correct or not right now. 

Isn’t that true? 

Mr. Beales. No. The underlying data is your credit report. And 
that information, you can know whether it is correct or not. 

Senator Schumer. But I don’t know what exactly is going into 
it. 

Mr. Beales. You do not know exactly which pieces matter. That 
is certainly correct. But if all of the information there is accurate, 
then it is not going to affect your credit score. 

The other thing, in the credit denial, if you get denied, under the 
Equal Credit Opportunity Act, you get an adverse action notice for 
that purpose as well. And it will identify the top four reasons for 
that denial, the four things that most contributed to your credit 
score being too low. 
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Senator Schumer. And then if I find one of them is inaccurate 
and I wrote the credit company, they will correct it? 

Mr. Beales. When you notify the credit reporting agency, that 
triggers the reinvestigation requirement. They have to go back to 
whoever furnished that information. The furnisher either has to 
verify the information or delete it. 

Senator Schumer. And does that happen? 

Mr. Beales. Yes, sir, it does. 

Senator Schumer. Are there times when it doesn’t? 

Mr. Beales. Undoubtedly. 

Senator Schumer. Which is more? 

[Laughter.] 

Mr. Beales. We think it happens far more often than it doesn’t. 

Senator Schumer. Do we have data on that to know? 

I am sorry, Mr. Chairman. 

Chairman Shelby. No. I think what you are getting into is very 
important. 

Mr. Beales. I have seen data — there is an enormous number of 
corrections that get made, of changes that get made. 

Senator Schumer. I just find when you talk to your typical mort- 
gagor, when you talk to his real estate broker, his bank, her bank, 
there is huge dissatisfaction with the mystery of this system. 

And it is not just some theoretical need to know, that it creates — 
everyone scratches their head and cannot figure out a whole lot of 
the outcomes here. 

Am I wrong about that? The realtors made this one of their big 
issues. They weren’t doing it because everything is working right. 

Mr. Beales. I think what has tended to happen in response to 
participants in the process being frustrated by not understanding 
as much as they wanted to, is that more information has been pro- 
vided over time. 

Whether that frustration is still there or not, I do not know. That 
is not something that we experience on an ongoing basis. But I 
think the fundamental answer of trying to explain this system to 
consumers better, is exactly the right one. And that is what we try 
to do in our consumer education materials. 

Senator Schumer. Thank you, Mr. Chairman. 

Chairman Shelby. Could we say, as far as scores go, there is 
pervasive use and limited consumer understanding? 

Obviously, I bet there is not two people in this room, maybe five, 
that would explain — maybe the credit bureau people here — ^but that 
could explain that scoring. 

Senator Schumer. Maybe one of them brought the little black 
box. 

Chairman Shelby. Yes, the little black box. 

[Laughter.] 

So, I think the case has been made for very limited, at least at 
this period — we will have more hearings — ^but for limited consumer 
understanding of how they are scored. 

Mr. Beales. I think they certainly do not understand the details 
of how their scores are calculated. 

What credit scoring replaced was a system that was essentially 
judgmental, which I think was, if anything, less transparent to con- 
sumers. 
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Chairman Shelby. This is judgmental, too. It is just done by 
computer. 

Right? It is based on a model of so and so. 

Mr. Beales. It is based on objective data, as opposed to being 
based on my personal assessment of you and whether you are a 
good credit risk or not. 

Chairman Shelby. I did not say it was good or bad. It may be 
a big improvement. I am just saying it is still a judgment is made. 

Mr. Beales. Yes, I think that is right. 

Chairman Shelby. By an individual or by a computer. 

Mr. Beales. The judgment is made based on actual experience 
analyzed in a statistically rigorous fashion. 

Chairman Shelby. And no human flesh. 

Mr. Beales. Right, as opposed to my opinion based on whatever 
it might be based on. 

Chairman Shelby. Senator Sarbanes mentioned earlier that we 
balance all interest legislatively, or try to balance. 

That is part of the legislative process. 

We have talked about preemption, the merits of it, the problems 
with it, and so forth. But he asked you, as I understood it, could 
this be balanced? 

Could the case be made — I am talking up here and later — for 
preemption which would benefit the creditors, benefit the con- 
sumers, ultimately, our national system, and at the same time, a 
standard for the consumers, you know, improve the standard for 
the consumers on notice and a lot of other things. Identity theft 
concerns and so forth. 

Mr. Beales. I think, certainly, that that can be done. 

Chairman Shelby. Balancing the interest, is it not? 

Mr. Beales. It is a balancing of the interests. And we have tried 
on an ongoing basis to assess whether there are problems, where 
there may be the possibility for improvements that would make the 
system work better. 

That, presumably, if you did not extend preemption, presumably, 
that is the process that individual States would go through. 

But you can do that here, too. 

Chairman Shelby. And the possibility of Balkanization, doesn’t 
it? 

Mr. Beales. Yes, it does. You can do it here and have it uniform 
and an improvement as well, if in fact the particular change is an 
improvement. 

Chairman Shelby. Your testimony is made part of the record 
and then some of your oral testimony here, is full of references to 
the dynamic nature of the credit markets. 

How do you make sure that the FCRA, the Fair Credit Reporting 
Act, legal regime and the interests that it is supposed to balance 
and protect, stays abreast, stays up with the real-world develop- 
ments in these markets? 

And what are your views as to the adequacy of the current regu- 
latory structure? Is the Commission that you work with, the 
enforcement authority enough, or is there a need to expand your 
role to provide you with rulemaking authority? Are there other 
ways that we should consider to build in greater flexibility to help 
you do your job? 



43 


Mr. Beales. The Commission has not taken a position at this 
point about rulemaking authority for the Commission. I think, ge- 
nerically, it is a good practice for regulators and it is good practice 
for the Congress to periodically review how regulations and regu- 
latory schemes fit with the real world and whether they need to be 
adapted in light of underlying changes. 

Chairman Shelby. Okay. We appreciate your appearance here 
today. We look forward to working with you, and we thank you. 

Mr. Beales. We thank you. 

Chairman Shelby. The hearing is adjourned. 

[Whereupon, at 4:35 p.m., the hearing was adjourned.] 

[Prepared statements, response to written questions, and addi- 
tional material supplied for the record follow:] 
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PREPARED STATEMENT OF SENATOR ELIZABETH DOLE 

I would like to thank both you and Ranking Member Sarbanes for agreeing to 
hold this hearing on the issues raised by the reauthorization of the Fair Credit 
Reporting Act. Enacted in 1970, the Fair Credit Reporting Act has served an impor- 
tant role in this Nation. In the time since its first passage it is astounding to con- 
sider the fundamental changes which have occurred in our credit system. In 1970, 
credit card charges over $20 required the store owner to call the creditor and have 
a staffer go through a card catalog system to approve the transaction. Today, it 
takes just seconds, even when you are on the other side of the world. While we take 
this innovation for granted it demonstrates how fundamentally our system of pay- 
ments has changed. 

In addition, the benefits of the Fair Credit Reporting Act have also been respon- 
sible for many of the advancements in how we choose financial products which best 
meet our needs. A system of fairly and rapidly assessing an individuals financial 
responsibility ensures that people can have quick access to competitive offers for 
credit, insurance, or other financial products. Clearly, our current credit system has 
been one of our Nation’s best assets to benefiting individuals at every level of the 
economic ladder. This unprecedented access to credit combined with the low cost for 
credit realized through the efficiencies produced by law have created new opportuni- 
ties for people who have never had access to credit before. No longer is collateral 
essential in qualifying for a loan, people can now raise themselves on the ladder of 
economic success simply by proving that they can responsibly handle their financial 
affairs. 

Given this opportunity to reauthorize the Fair Credit Reporting Act, we must 
ensure that our actions do not result in increases in the cost of credit and lower 
access to credit. To do so could have harmful effects on our recovering economy. At 
the same time we must ensure that the law applies to everyone fairly and that the 
system to protect consumers against questionable material on credit reports oper- 
ates efficiently and effectively. 

I look forward to hearing the thoughts and observations of our witness and to 
working with all of my colleagues on the Committee as we reauthorize this very im- 
portant law this year. 

Thank you. 


PREPARED STATEMENT OF SENATOR TIM JOHNSON 

Chairman Shelby, thank you for holding today’s hearing on the Fair Credit 
Reporting Act. While FCRA is not exactly a household name, our Nation’s credit- 
granting system is one of the bright points in our otherwise lackluster economy. 
Outstanding consumer credit has grown from $556 billion in 1970 when FCRA was 
enacted to $7 trillion today, accounting for over two-thirds of U.S. gross domestic 
product. Which is why today’s hearing is so timely. Unless we act by the end of the 
year to reauthorize FCRA’s preemption provisions, we risk striking a terrible blow 
to our economy by our inaction. 

As today’s witness has noted in his very thoughtful written testimony, “the con- 
sumer reporting industry, furnishers, and users can all rely on the uniform frame- 
work of the FCRA in what has become a complex, nationwide business of making 
consumer credit available to a diverse, mobile American public.” Yet if we fail to 
act by January 1, 2004, this uniform reporting system could break into as many as 
50 credit reporting systems, all with different standards, different requirements, 
and different procedures. 

Most people do not know much about our credit reporting system because it works 
so well. It does not occur to people to learn about what goes into a credit report 
until they get turned down for credit. And under the FCRA, those who do get turned 
down receive all the protections that come with a so-called “adverse action.” They 
have the right to a free credit report; they have the right to dispute what informa- 
tion is contained in that report; they have the right to a quick investigation of the 
information; and they have the right to a timely correction. And those rights apply 
to everyone, regardless of whether they live in South Dakota or Alabama. 

Full-file credit reports are unique to the United States. Unlike other countries, 
where only consumers with negative credit history have any kind of record, our sys- 
tem encourages data furnishers to report both negative and positive credit history, 
all on a voluntary basis. This information allows lenders to make informed decisions 
about a given consumer’s credit risk and to make better lending decisions. 

These decisions are good for consumers in a variety of ways. For some, full-file 
reporting may allow a lender to take a chance on a consumer whose positive credit 
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history may offset a past credit impairment. For others, more complete information 
may help a lender to decide not to extend more credit than a consumer can handle. 

By the same token, full-file reporting helps lenders make sensible decisions that 
keep our financial institutions safe and sound. Poor lending decisions affect all of 
us through institutional instability and an increased cost of credit. 

Other elements of FCRA are also critical to our credit-granting system. For exam- 
ple, in the modern economy, it’s important to maintain a nationwide standard under 
which corporate affiliates may share information. Experts such as Chairman Green- 
span have emphasized the need for national businesses, which serve customers in 
all 50 States, to have uniform standards across those 50 States. Failure to maintain 
this uniformity would jeopardize many of the efficiencies gained through informa- 
tion technology and wider consumer choice. 

Mr. Chairman, I believe that a uniform national credit reporting system must be 
maintained, which is why I introduced the Economic Opportunity Protection Act of 
2003, S. 660, which would extend the preemption provisions currently contained in 
FCRA. 

At the same time, I commend you for holding the first in what I hope will be a 
series of hearings on the FCRA. As Congress noted when it created the FCRA, con- 
sumer credit “is dependent upon fair and accurate credit reporting.” Therefore, it 
is appropriate for Congress to look at whether the statute is working properly and 
whether any of the provisions need to be amended to reflect changes in the market- 
place. 

I understand many on this Committee and in the Administration have a par- 
ticular interest in identity theft, and I share this concern. In fact, I believe that a 
uniform national credit reporting system, if used properly, can be one of our most 
effective weapons to combat this growing problem. I hope as part of this year’s dis- 
cussion about FCRA, we can work together to develop solutions to what is a rel- 
atively new, yet extremely damaging, crime. 

That said, I am disappointed that the Administration has yet to develop a position 
on this critical issue. It appears the Federal Trade Commission is also unwilling to 
tell this Committee its position on whether it is important to maintain a uniform 
national standard for our credit reporting system. I would urge the Administration 
over the coming weeks to devote more attention to the imminent expiration of FCRA 
preemption provisions and to develop a recommendation that can inform Congress’ 
deliberation on this issue. 

Mr. Chairman, I look forward to today’s testimony. 


PREPARED STATEMENT OF SENATOR JIM RUNNING 

I would like to thank you, Mr. Chairman, for holding this very important hearing 
and I would like to thank our witness for testifying today. 

Today, we have the first of a number of hearings on the Fair Credit Reauthoriza- 
tion Act. As we all know, FCRA is a huge issue for the financial industry and con- 
sumer groups. There are some who think we need to pass a clean FCRA, some who 
think we should pass FCRA but with additional privacy and identity theft protec- 
tions and some who think privacy decisions would be left to the States. I believe 
these hearings will be a great help to Members in deciding which is the best course 
of action to take. 

I have been involved in the privacy debate for a number of years. During the early 
1990’s, I worked with the Kentucky General Assembly to remove the Social Security 
number for Kentucky drivers’ licenses. In the House, as Chairman of the Social Se- 
curity Subcommittee of the Ways and Means Committee, I led the effort to stop the 
Social Security Administration from posting SSA earnings online. And of course, all 
of us who were on this Committee in 1999 were deeply involved in privacy issues 
during Gramm-Leach-Bliley. 

I certainly believe more can be done to prevent identity theft. I would like to see 
more restricted use of the Social Security number. I would like to see those who 
have had the privacy stolen to have better means to get their credit problems fixed. 
And I, like everyone else, would like to stop getting flooded with mail and getting 
solicitation calls during dinner. 

But I have another concern. I am very concerned about this economy. I am very 
worried about the possibility of a double-dip recession. I know that puts me at odds 
with more optimistic economic experts, like Chairman Greenspan, but we have dis- 
agreed before. We are not growing like we can, and we are not creating jobs. There 
are many reasons for this. I believe Chairman Greenspan acted way to slow to cut 
rates back in early 2001. He should have cut them in the fall of 2000. The corporate 
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governance scandals have hurt trust in the markets. Sarbanes-Oxley and other ac- 
tions have helped, but it will take a long time for corporate America to rebuild that 
trust. September 11, had a devastating effect on our economy. The two wars we 
have had since then have also not helped. 

The reason why most of these events have been so harmful to this economy is 
because they have created uncertainty in our markets. If there is one thing that 
shakes the markets, it is uncertainty. I am afraid that talk of not renewing FCRA 
is creating a lot of uncertainty in the financial markets. If we have 50 different pri- 
vacy standards, it will be difficult for financial companies to sell their products na- 
tionwide. If counties and municipalities get in the act, and some already have, it 
will be even more difficult. 

I think it is crucial that we pass an FCRA extension this year. We must bring 
some certainty back to the markets if we are ever going to grow this economy and 
prevent a double-dip. 

Again, Mr. Chairman, thank you for holding this important oversight hearing. 


PREPARED STATEMENT OF SENATOR DEBBIE STABENOW 

Thank you, Mr. Chairman. I will be brief because I want to get quickly to our 
witness today. I appreciate your calling this hearing and I hope that we, as a Com- 
mittee, will move quickly to address the expiring provisions of the Fair Credit Re- 
porting Act. 

This session of Congress is going to move quickly and with just over 14 actual 
work weeks left before our target adjournment, the sooner we can began to move, 
the greater chances of having a thorough debate and passing the must-do legislation 
behind today’s hearing. 

The FCRA has served our country well over the past 33 years. Indeed, as a result 
of the statue, the improved access to consumers’ previous credit-related behavior has 
allowed creditors all over the country to extend credit more quickly and priced on 
appropriate risk. People with low-credit risks as a result of FCRA can now get lower 
rates and those with higher risks can now get credit with higher rates when pre- 
viously they would have probably just been denied any credit at all. In addition, we 
no longer have to wait days and days or even weeks to get credit decisions. We can 
get them instantaneously. Furthermore, credit scoring models have taken much of 
the arbitrariness and guess work out of extending credit. All of this makes our econ- 
omy more efficient saving time and allowing us to allocate the costs of borrowing 
appropriately. 

Mr. Chairman, I believe we should do everything we can to bolster the system 
we have in place today. I hope as we reexamine the FCRA we will be careful to 
take no actions that would undermine or limit the effective and appropriate sharing 
of credit information. I also hope that we would make sure that consumers have full 
information about and absolute control over their personal credit information. We 
should also ensure that there are appropriate privacy safeguards under our law. 

I commend you for your leadership on this issue, Mr. Chairman, as well as others 
on our Committee such as Senator Tim Johnson who has taken an active interest 
and has his own legislation dealing with FCRA. I look forward to working with all 
of my colleagues as we take up the reauthorization of the expiring provisions of the 
FCRA and I look forward to our FTC witness, before us today. 

Thank you. 


PREPARED STATEMENT OF J. HOWARD BEALES, III 

Director, Bureau of Consumer Protection, U.S. Federal Trade Commision 

May 15, 2003 

Introduction 

Mr. Chairman and Members of the Committee, my name is Howard Beales, and 
I am Director of the Bureau of Consumer Protection of the Federal Trade Commis- 
sion (Commission or FTC). I am pleased to have this opportunity to provide back- 
ground on the Fair Credit Reporting Act (FCRA).i The Commission has played a 
central role in interpreting and enforcing the FCRA since the law was enacted in 


1 While the views expressed in this statement represent the views of the Commission, my oral 
presentation and responses to questions are my own and do not necessarily reflect the views 
of the Commission or any individual Commissioner. 
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1970. I appreciate the opportunity to discuss the FCRA and its role in regulating 
credit report information. 

Consumer Credit Reporting 

The development of consumer credit was a phenomenon of the post-World War II 
years. Prior to that time, consumer credit relationships were largely personal be- 
cause many consumers lived in one place all their lives and dealt only with local 
merchants and banks. After World War II, the American population grew and be- 
came vastly more mobile. Consumer credit also exploded for many reasons, includ- 
ing pent-up demand for consumer goods and services and fading of the cash-only 
Depression psychology. At the same time there was an increased demand for home- 
ownership. In response, the Government supported the growth of a long-term con- 
sumer credit market. For all these reasons, the amount of consumer credit out- 
standing has grown exponentially.^ Indeed, consumer spending accounts for over 
two-thirds of U.S. gross domestic product and consumer credit markets drive U.S. 
economic growth.® 

The credit reporting industry developed in tandem with the burgeoning of con- 
sumer credit. Early on, credit reporting was local or regional and relatively unso- 
phisticated; the amount of information collected was limited and not standardized. 
Credit bureaus (consumer reporting agencies) manually recorded consumer infor- 
mation on index cards, updated irregularly, and often retained indefinitely. Over 
time, however, small credit bureaus grew to become large repositories of information 
on consumers.® 

Today, the credit reporting system, consisting primarily of three main credit bu- 
reau repositories, contains data on as many as 1.5 billion credit accounts held by 
approximately 190 million individuals.® Creditors and others voluntarily submit this 
information to centralized, nationwide repositories. Lenders analyze this data and 
other information to develop sophisticated predictive models to assess risk, as re- 
flected in the consumer’s credit score.^ The flow of information enables credit 
grantors to make more expeditious and accurate credit decisions, which benefits con- 
sumers as a whole. These benefits are illustrated by a study of credit bureau files 
that found that nearly 20 percent of the currently reported active accounts had been 
open for less than 12 months.® 

The modernization of credit reporting has played a key role in providing American 
consumers rapid access to consumer credit. It was not that many years ago that ap- 
plying for credit required a personal visit to a loan officer. The loan officer, if he 
did not know you personally, contacted your references, including other creditors, 
before making a decision on your application. If you were new to the community or 
applying for credit for the first time, you might get turned down or be approved for 
only a small, entry-level loan. The decision would often take days and would be 
based solely on the judgment of the loan officer. 


®In 1946, the beginning of the post-war period, total outstanding consumer credit stood at $55 
billion; by 1970, the time of enactment of the FCRA, it had grown to $556 billion. [Figures ad- 
justed for inflation.] Today it is $7 trillion. See Fred H. Cate, Robert E. Litan, Michael Staten, 
and Peter Wallison, “Financial Privacy, Consumer Prosperity, and the Public Good: Maintaining 
the Balance,” AEl-Brookings Joint Center for Regulatory Studies, March 2003, at 1. 

3/d. at 8. 

^“Consumer reporting agency” is the term used in the FCRA, and reflects the fact that con- 
sumer information is collected and reported for a variety of purposes in addition to credit trans- 
actions. In common terminology, however, the agencies are known as “credit bureaus” or “credit 
reporting agencies.” (Similarly, “credit report” and “credit history” are commonly used nontech- 
nical terms for “consumer report.”) The term “repository” is most often reserved for the large, 
national bureaus that collect and store information on over 190 million consumers. The “reposi- 
tory” agencies, in turn, are sometimes referred to as the “big three,” in recognition of the three 
major companies that have predominated for several years — Equifax, Experian, and 
TransUnion. A fourth company, Innovis Data Services (an affiliate of CBC Companies), also 
maintains “a national database of consumers with unfavorable current or past credit histories.” 
See http: I / www.innovis-cbc.com/products.htm. 

3 For a more complete recitation of the early history of the consumer reporting industry, see 
Retail Credit Co., 92 F.T.C. 1 at 134-36 (1978). 

®See “An Overview of Consumer Data and Credit Reporting,” Federal Reserve Bulletin, Feb- 
ruary 2003, at 49. 

Scoring products are based on analyses of historical consumer credit data, which allow credi- 
tors to develop models that help them predict the risk of default of a particular consumer. (The 
products are thus sometimes referred to as “risk scores” or “credit scores.”) When the consumer 
applies for credit or other goods or services, the scoring programs that are developed from the 
complex analysis of past data compare the scoring factors to the individual information of the 
particular consumer, with the result reflected in a score that is generated for that application. 

3 See “An Overview of Consumer Data and Credit Reporting,” Federal Reserve Bulletin, Feb- 
ruary 2003, at 52, table 2 (“All credit accounts and balances. . .”). 
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By contrast, consumers today can use the Internet from the comfort of their home 
to comparison shop for a wide array of credit products and get a virtually instanta- 
neous offer, including rate and other terms. Or, they can obtain a five-figure loan 
from an auto dealer they have never been to before and drive a car away from the 
showroom the same day. In each instance, their eligibility for the lowest rate or 
most favorable terms depends on a sophisticated credit scoring system that produces 
rapid, reliable scores based on information from a consumer report. 

Chairman Greenspan of the Board of Governors of the Federal Reserve System 
put it well when he recently testified that “. . .there is just no question that unless 
we have some major sophisticated system of credit evaluation continuously updated, 
we will have very great difficulty in maintaining the level of consumer credit cur- 
rently available because clearly, without the information that comes from various 
credit bureaus and other sources, lenders would have to impose an additional risk 
premium because of the uncertainty before they make such loans or may, indeed, 
choose not to make those loans at all. So it is clearly in the interests of consumers 
to haye information continuously flowing into these markets. It keeps credit avail- 
able to everybody, including the most marginal buyers. It keeps interest rates lower 
than they would otherwise be because the uncertainties which would be required 
otherwise will not be there.” ^ 

Before describing some of the primary elements of the FCRA, let me describe 
briefly how the consumer reporting system works in this country today. Creditors 
yoluntarily report account histories to consumer reporting agencies. Typically, 
creditors report full account payment information, both “positiye” information that 
the account is current, as well as “negative” information, such as delinquencies and 
collection accounts. This contrasts with practices in some other countries (and, in- 
deed, with some credit bureaus in the early years of their development in this coun- 
try) where only negative payment history is reported. 

Although the credit reporting industry has developed uniform reporting formats 
and methods, not all creditors necessarily report to all major repositories. More- 
over, credit reporting agencies have different schedules and procedures to augment 
individual consumer files with updated data from creditors. Consumer reporting 
agencies also obtain information from other sources, such as public record data. For 
all of these reasons, at any given point in time, each of the credit reports on an indi- 
vidual as supplied by the three major repositories may contain somewhat different 
information, As a result, in the residential mortgage market, for example, credi- 
tors use credit reports produced by resellers who consolidate the data available from 
the three major repositories. 

When a consumer applies for credit, lenders obtain consumer reports by providing 
identifying information on the consumer to the credit bureau. The credit bureau pro- 
vides a full report listing all accounts and payment histories and/or a credit score, 
which is a numerical classification based on information in the consumer report, 
The credit agencies also handle other functions (including those required by the 
FCRA, such as responding to consumer disputes) through uniform industry 
processes. The importance of these additional functions has grown along with con- 


^ Remarks following testimony by Alan Greenspan, Chairman of the Board of Governors of the 
Federal Reserve System, April 30, 2003, House Financial Services Committee, at 12. 

i®Each of the three national credit reporting companies receives more than 2 billion items 
of information each month. See “An Overview of Consumer Data and Credit Reporting,” Federal 
Reserve Bulletin, February 2003, at 49. 

Although the majority of creditors report full account information, some types of accounts 
are typically reported only when the payment history turns negative, most often when the debt 
is transferred to a debt collector. Accounts related to medical debts, telecommunications, and 
power companies are the most common examples. See “An Overview of Consumer Data and 
Credit Reporting,” Federal Reserve Bulletin, February 2003, at 50, 68. To the extent that con- 
sumers have positive payment history only from nontraditional credit such as rent and utilities, 
this may limit their access to credit. 

^^See, e.g.. The World Bank, “World Development Report 2002,” at 95 (2002); John M. Barron 
and Michael Staten, “The Value of Comprehensive Credit Reports: Lessons from the U.S. Expe- 
rience,” at 14, available online at http: ! t wivw.privacyalliance.org ! resources t staten.pdf {2bhQ) 
(comparing the United States comprehensive credit reporting system to the Australian negative- 
information-only system). 

See http:! I www.cdiaonline.orgldata.cfm for information on the uniform reporting format 
utilized by most creditors and other furnishers of information to consumer reporting agencies. 

11 See “An Overview of Consumer Data and Credit Reporting,” Federal Reserve Bulletin, Feb- 
ruary 2003, at 50-51, 70—71. 

1® Between 2 and 3 million consumer reports are issued by credit bureaus each day. See http: ! 
/ www.cdiaonline.org / about.cfm. For a brief description of scores, see Note 7, supra. 

i®The Consumer Data Industry Association (CDIA) is a trade association for major consumer 
reporting agencies. Among other steps to promote standardized automated procedures between 
and among consumer reporting agencies and furnishers of information to agencies, CDIA over- 
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cerns about identity theft, because credit reporting agencies play a major role in 
limiting the damage and correcting the fraudulent records that identity thieves 
leave behind. 

FCRA Overview 

Background 

Along with the growth of consumer credit, and the parallel development of con- 
sumer reporting agencies, concerns began to surface about the treatment of con- 
sumer information in credit reporting. The credit reporting industry had evolved 
piecemeal, and there was little consistency in methods of data collection or, before 
the FCRA, standards of retention or accuracy. For example, there were no Federal 
legal restrictions on access to consumer credit data, so reporting agencies were free 
to share a wide range of information with credit grantors and others, without regard 
to the purpose for which the information was sought. Consumer awareness of credit 
reports was low due, in part, to the fact that users of reports were contractually 
prohibited by credit bureaus from disclosing the reports to consumers. Even if a 
consumer could learn what was in his or her credit report, there was no way for 
the consumer to challenge erroneous information. 

In response to rising concerns about the consumer reporting system, and recog- 
nizing its importance to business and consumers. Congress held hearings that 
resulted in passage of the FCRA to provide a framework for the industry and to se- 
cure protections for consumers. In enacting the FCRA, Congress specifically recog- 
nized that consumer credit “is dependent upon fair and accurate credit reporting.” 

The 1970 FCRA imposed duties primarily on consumer reporting agencies, with 
very limited requirements on those that use credit reports, and no provisions aimed 
at those who furnished information to the reporting agencies. 

The consumer reporting industry and the consumer credit economy changed 
tremendously in the decades following the enactment of the FCRA. The comput- 
erization of credit histories into vast databases accelerated markedly. The industry 
further consolidated, eventually comprising three major credit bureau repositories 
that maintain large, automated databases of consumer information, and a limited 
number of other agencies.^° Logistical challenges associated with increased comput- 
erization and further changes in the industry led to an increase in complaints about 
mixed files — inclusion in a single file of information belonging to two or more dif- 
ferent individuals — and other consumer report inaccuracies. More generally, the 
American public has become increasingly aware of privacy issues related to personal 
information. 

In 1996, after several years of legislative consideration. Congress passed signifi- 
cant amendments to the FCRA. The amendments built on the core elements of the 
original FCRA and provided added protections to consumers in several key areas. 
The amendments also permitted greater sharing of consumer report information by 


sees a system for credit bureaus to forward consumer disputes to furnishers for investigation. 
Disputes are forwarded on standardized Automated Consumer Dispute Verification (ACDV) 
forms. The system now has a web-based component, E-OSCAR, that is intended to further en- 
hance the flow of consumer disputes, update information, and other data. The automated dis- 
pute system not only provides a uniform format for conveying the disputes, it also serves an 
implicit authenticating function — a creditor who receives a consumer dispute via the system 
knows that the forwarding entity has been approved by CDIA for use of the system. 

Identity theft occurs when someone commits fraud by using another person’s identifying in- 
formation, such as date of birth, Social Security number, or credit account numbers. The fraud 
could include applying for or using credit in another’s name, obtaining bank loans, employment, 
utility services (including cell phones), or similar illegal conduct in the “true name” identity of 
the consumer whose information was misappropriated. 

Congress was especially concerned about this lack of awareness in the context of “investiga- 
tive consumer reports” — reports on a consumer’s character, general reputation, personal charac- 
teristics, or mode of living, obtained through personal interviews with neighbors, friends, or 
associates of the consumer — and thus provided special notice and disclosure requirements, to- 
gether with other provisions, for investigative reports. Section 606 of the FCRA; 15 U.S.C. 
§ 1681d. 

Section 602(a)(1), the Congressional findings and statement of purpose for the FCRA. 15 
U.S.C. § 1681(a)(1). 

20 At present, the three largest bureaus are TransUnion, Experian (formerly owned by TRW), 
and Equifax. Although some local bureaus still remain, most are affiliated in some fashion with 
one of the “big three” repositories. The industry has also witnessed the emergence of companies 
that collect and report specialized information such as check writing histories, rental records, 
and employment applications. The 1990’s saw the growth of “resellers,” consumer reporting 
agencies that purchase consumer information from one or more of the major repositories and 
then resell it, usually after reformatting, categorizing, or otherwise treating the information. All 
of these entities are covered by the FCRA. 
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affiliated companies under certain conditions, and granted more flexibility to 
creditors and insurers in making prescreened offers, for example, obtaining lists of 
consumers based on consumer report information, in order to make offers of credit 
or insurance to consumers who the offeror deems qualified.22 Let me briefly review 
some of the important elements of the FCRA as it stands today, 33 years after its 
original passage. 

Key FCRA Provisions 

As I discussed earlier, the FCRA establishes a framework that enables businesses 
to engage in the information exchanges necessary for the proper functioning of the 
credit markets. At the same time, it provides corresponding consumer protections 
in two vital areas — privacy and accuracy. It is important to keep in mind that, not- 
withstanding its title, the Fair Credit Reporting Act has always covered more than 
what are conventionally termed “credit reports.” It applies generally to any informa- 
tion collected and used for the purpose of evaluating consumers’ eligibility for prod- 
ucts and services that they want. Thus, the FCRA has always applied to insurance, 
employment, and other noncredit consumer transactions.^^ The focus here will be 
on credit reporting, but the same basic regulatory structure applies to all consumer 
reports. 

Privacy 

As recognized by Congress in its initial passage of the FCRA, the confidentiality 
of consumer report information is a fundamental principle underlying the statute.^^ 

Permissible purposes. The FCRA is designed to protect consumer privacy in a 
number of ways. Primarily, it limits distribution of credit reports to those with 
specific, statutorily defined “permissible purposes.” Generally, reports may be pro- 
vided for the purposes of making decisions involving credit, insurance, or employ- 
ment.26 Consumer reporting agencies may also provide reports to persons who have 
a “legitimate business need” for the information.^'^ Under the FCRA, Government 
agencies are treated like other parties — that is, they must have a permissible pur- 
pose to obtain a credit report.^® The written instructions of the consumer may also 
provide a permissible purpose for a consumer reporting agency to furnish a credit 


21 Section 603{d)(2)(A)(iii) exempts from the FCRA communication of information among affili- 
ates, if it is clearly and conspicuously disclosed to the consumer that the information may be 
communicated and the consumer is given the opportunity to opt out of such information sharing. 
15 U.S.C. §1681a(d)(2)(A)(iii). 

22 Prescreened offers, which are discussed in more detail below, are unsolicited “firm offers” 
of credit or insurance that are based on information from consumer reports. Generally they take 
the form of lists of consumers to whom credit grantors make offers of credit — the most obvious 
example is mailed promotions of credit cards. These lists are assembled by credit bureaus based 
on criteria set by the credit grantor; the bureau screens its consumer files (except those that 
have opted out of prescreened offers) for all consumers who meet the creditor’s criteria. Gen- 
erally speaking, the FCRA requires that all consumers who survive the prescreen must receive 
a “firm offer” of credit. Prescreened lists are thus an exception to the general rule that credit 
reports can be furnished only when a consumer initiates a transaction or has a preexisting rela- 
tionship with the creditor seeking a copy of the report. See H. Rep. 103-486, 103rd Cong., 2nd 
Sess., 32-33 (1994). 

23 “It is the purpose of this title to require that consumer reporting agencies adopt reasonable 
procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and 
other information. . .” Section 602(b) of the FCRA; 15 U.S.C. §1681(b). 

24 The Congressional findings note the “. . .need to insure that consumer reporting agencies 
exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer’s 
right to privacy.” Section 602(a)(4); 15 U.S.C. § 1681(a)(4). Under the “reasonable procedures” 
portion of the statement of purpose for the FCRA, Congress noted the importance of the “con- 
fidentiality” of consumer report information. Section 602(b); 15 U.S.C. § 1681(b). 

23 What constitutes a “consumer report” is a matter of statutory definition (Section 603(d); 15 
U.S.C. § 1681a(d)) and case law. Among other considerations, to constitute a consumer report, 
information must be collected or used for “eligibility” purposes. That is, the data must not only 
“bear on” a characteristic of the consumer (such as credit worthiness, credit capacity, character, 
general reputation, or mode of living), it must also be used in determinations to grant or deny 
credit, issue insurance, make employment decisions, or make other determinations regarding 
permissible purposes. TransUnion Corp. v. FTC, 81 F.3d 228, 234 (D.C. Cir. 1996). 

26 Section 604(a)(3); 15 U.S.C. § 1681b(a)(3). Credit reports may also be furnished for certain 
on-going account-monitoring and collection purposes. 

2'^ 15 U.S.C. § 1681b(a)(3)(F). See also Note 33, infra, and text accompanying. 

28 Under Section 608 of the FCRA, Government entities may obtain limited identifying infor- 
mation (name, address, employer) without a “permissible purpose.” 15 U.S.C. § 1681f. The 
FCRA, additionally, now contains express provisions on Government use of consumer reports for 
counterintelligence and counter-terrorism. Sections 625 and 626, respectively; 15 U.S.C. 
§§1681u, 1681v. 
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report.^® Under the FCRA, target marketing — making unsolicited mailings or tele- 
phone calls to consumers based on information from a credit report — is generally not 
a permissible purpose.^® In a 1992 Commission action to enforce the FCRA against 
a consumer reporting agency that sold target marketing lists assembled using con- 
sumer report information, the court of appeals held that . .a major purpose of the 
Act is the privacy of a consumer’s credit-related data.”^^ If consumer information 
is “so sensitive as to rise to the level of a consumer report,” then it must . .be 
kept private except under circumstances in which the consumer could be expected 
to wish otherwise or, by entering into some relationship with a business, could be 
said to implicitly waive the Act’s privacy to help further that relationship.” 

The 1996 Amendments added provisions that reflected Congress’ awareness of in- 
creased public concern about the privacy of personal information. For example, Con- 
gress added, for the first time, an express provision stating that the “legitimate 
business need” permissible purpose requires that the transaction be “initiated by 
the consumer.” Congress also added express language prohibiting any person from 
obtaining a consumer report without a permissible purpose. 

Consumer right to opt out of prescreening. The 1996 Amendments also added an 
express permissible purpose for prescreening. As noted above, prescreened offers are 
unsolicited offers of credit or insurance that are made (typically in mass mailings) 
to consumers who were selected for the offer based on information in their credit 
reports. Prior to the 1996 Amendments, the FCRA did not specifically address the 
use of consumer reports for such unsolicited offers. The Commission, however, had 
issued an interpretation of the FCRA in 1973 that permitted the use of consumer 
reports by creditors for unsolicited offers of credit if creditors followed guidelines set 
forth in the Commission’s interpretation.^^ Those guidelines required every con- 
sumer on any list resulting from the use of consumer reports to receive a firm offer 
of credit — for example, the offer must be unconditional; all the consumer had to do 
to receive the credit was to accept the offer. 

In the 1996 Amendments, Congress added a number of provisions to the FCRA 
to provide an explicit statutory framework for prescreening.^® The legislative 


29 Other permissible purposes specified in the FCRA include (1) in response to an order of a 
court or a Federal grand jury subpoena; (2) in connection with a determination of the consumer’s 
eligibility for a license or other benefit granted by a governmental instrumentality required by 
law to consider an applicant’s financial responsibility or status; and (3) in response to a request 
by the head of a State or local child support enforcement agency if the person making the re- 
quest certifies to the credit bureau that certain conditions are met (and in certain other child 
support circumstances). Section 604(a); 15 U.S.C. §1681b(a). 

^9 Prescreening, discussed more fully below at notes 35—41 and accompanying text, is a form 
of target marketing for firm offers of credit or insurance, for which the FCRA now provides an 
explicit permissible purpose keyed to adherence to statutory procedures, including affording con- 
sumers the opportunity to opt out of future prescreened solicitations. See also Note 22, supra. 

^^TransUnion Corp. v. FTC, 81 F.3d 228, 234 (D.C. Cir. 1996). The TransUnion case has a 
long history. The Commission issued an administrative complaint in 1992, and a Commission 
administrative law judge (ALJ) granted summary judgment to complaint counsel, and was af- 
firmed by the full Commission. 118 F.T.C. 821 (1994). On appeal, the case was remanded back 
to the ALJ for a trial. TransUnion Corp. v. FTC, 81 F.3d 228 (D.C. Cir. 1996). After a trial, 
the ALJ issued another decision in the Commission’s favor, which was affirmed by the full Com- 
mission. F.T.C. (2000). This decision was affirmed by the U.S. Court of Appeals 

for the D.C. Circuit, and certiorari was denied by the Supreme Court. TransUnion Corp. v. FTC, 
245 F.3d 809, reh. denied 267 F.3d 1138 (D.C. Cir. 2001), cert, denied, 122 S. Ct. 2386 (June 
10, 2002). 

^^Id. 

Section 604(a)(3)(F)(i); 15 U.S.C. 1681b(a)(3)(F)(i). The review of an account “to determine 
whether the consumer continues to meet the terms of the account” supplies the other “legitimate 
business need” of this permissible purpose. Section 604(a)(3)(F)(ii); 15 U.S.C. 1681b(a)(3)(F)(ii). 

^^The 1970 FCRA prohibited consumer reporting agencies from furnishing consumer reports 
to those who do not have a permissible purpose, but there was no analogous provision aimed 
at those who obtained consumer reports (with the exception of a criminal provision imposed on 
those who obtained information on a consumer “under false pretenses.” Section 619, 15 U.S.C. 
§ 1681q). 

16 CFR § 600.5 (withdrawn in 1990 when the Commission Commentary was published; see 
notes 52—53, infra). The Commission’s rationale for permitting prescreening was that the mini- 
mal invasion of consumer privacy involved in prescreening was offset by the fact that every con- 
sumer received an offer of credit. The four banking regulatory agencies also interpreted the 
FCRA to sanction prescreening for the entities under their jurisdiction. 

Sections 603(/); 604(c) and (e); and 615(d); 15 U.S.C. §§1681a(/), 1681b(c) and (e), and 
1681m(d), respectively. “Firm offer of credit or insurance,” the term used by Congress for what 
is commonly known as “prescreening,” is defined in Section 603(/), which also contains much 
of the operable language governing prescreening. The permissible purpose is set out in Section 
604(c) and the opt out scheme is contained in Section 604(e). Section 615(d) recites the disclo- 

Continued 
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process leading to the 1996 Amendments included an extensive consideration of 
prescreening issues. Congress ultimately chose to permit prescreening for both 
credit and insurance purposes, and to permit certain postscreening to protect the 
safety and soundness of the financial industry. 

At the same time, Congress provided an important mechanism for consumers to 
safeguard their privacy. Every written prescreened offer must provide notice of the 
consumer’s right to “opt out” of future prescreen lists. Credit bureaus must have 
a system, including a toll-free telephone number, that consumers can use to opt 
out,^® and they cannot include consumers who opt out on any subsequent 
prescreened list.^° The FCRA requires nationwide bureaus to maintain an opt out 
notification system, so that a notification by a consumer to one bureau is sufficient 
to have the consumer excluded from prescreened offers at all of the bureaus.^^ 

Accuracy 

Credit report accuracy was, and remains, a core goal of the FCRA. Because even 
small differences in a consumer’s credit score can influence the cost or other terms 
of the credit offer, or even make the difference between getting approved or denied, 
accuracy of the information underlying the score calculation is paramount. Accurate 
reports benefit not only consumers but also credit grantors, who need accurate infor- 
mation to make optimal decisions. These considerations provide significant incen- 
tives for all parties to maintain a high level of accuracy in consumer credit files. 
Congress recognized, however, that decisions based on inaccurate information can 
impose potentially severe consequences to individual consumers. Consequently, Con- 
gress enacted the FCRA accuracy protections.^^ 

The FCRA uses two major avenues to achieve the goal of optimal accuracy. First, 
it provides that consumer reporting agencies must follow “reasonable procedures to 
assure maximum possible accuracy of the information” they report.^^ Second, the 
FCRA establishes mechanisms for consumers to learn about possible errors in their 
credit reports and have them corrected. The statute gives consumers both the right 


sures required of those who use consumer reports to make prescreened offers. See H. Rep. 103- 
486, 103rd Cong., 2nd Sess., 32 (1994)(“The bill permits a consumer reporting agency to furnish 
limited information, commonly referred to as a prescreened list, in connection with such trans- 
actions only if the transaction consists of a ‘firm offer of credit,’ the consumer reporting agency 
has established a notification system whereby consumers can opt out to have their names ex- 
cluded from consideration from such offers of credit, and the consumer has not elected to be 
so excluded. Under the bill, a prescreened list, furnished by a consumer reporting agency in con- 
nection with a credit transaction that is not initiated by the consumer, may contain only certain 
types of information.”). 

Section 603(/) limits permissible postscreening to verifying that consumers continue to meet 
the criteria used in the prescreening and to verify any application information (such as income 
or employment) that is used in the process of granting credit or insurance. Credit grantors are 
also permitted to require that consumers furnish collateral so long as the collateral requirement 
is established before the prescreening is conducted and is disclosed to the consumer in the solici- 
tation that results from the prescreening. 15 U.S.C. § 1681a(/). See also H. Rep. 103-486, 103rd 
Cong., 2nd Sess., 33 (1994)(“The Committee recognizes that the furnishing of consumer reports 
for such credit solicitation is an exception to the general rule in Section 604(a)(3)(A) that con- 
sumer reports may be furnished by consumer reporting agencies only for credit transactions that 
are initiated by the consumer. Consequently, the Committee has established a special rule 
which permits the furnishing of consumer reports by a consumer reporting agency for credit 
transactions not initiated by the consumer, but only if the agency complies with strict limita- 
tions to ensure privacy protections for consumers. This special rule is a liberalization of an FTC 
interpretation of the FCRA.”). 

Section 615(d) requires that written prescreen offers make a clear and conspicuous state- 
ment that (i) information in the consumer’s credit report was used in the prescreen; (ii) the con- 
sumer was selected because the consumer met criteria for credit worthiness or insurability; (iii) 
the credit or insurance may not be extended if, after the consumer responds to the offer, the 
consumer does not continue to meet the criteria used to select the consumer for the offer; (iv) 
the consumer has the right to opt out of further unsolicited offers; and (v) the methods by which 
the consumer can notify the credit bureau of a decision to opt out. 15 U.S.C. § 1681m(d). 

39 Section 604(e)(5); 15 U.S.C. § 1681b(e)(5). 

40 Section 604(c)(l)(B)(iii); 15 U.S.C. § 1681b(c)(l)(B)(iii). 

bisection 604(d)(6); 15 U.S.C. § 1681b(d)(6). The opt out is effective for 2 years if conveyed 
by telephone, or permanently (unless revoked) if conveyed in writing. Section 604(d)(4)(B); 15 
U.S.C. §1681b(d)(4)(B). 

42 Section 602(a)(1) of the FCRA, Congressional findings and statement of purpose, notes that 
“Inaccurate credit reports directly impair the efficiency of the banking system. . ..” 15 U.S.C. 
§ 1681(a)(1). 

43 By its terms therefore (“reasonable procedures. . .maximum possible accuracy”), the statute 
itself recognizes that absolute accuracy is impossible. Section 607(b); 15 U.S.C. § 1681e(b). Prag- 
matic consideration of the large volume of data that credit bureaus must store and process also 
bears on this issue. See Notes 2, 5, 6, 10 and 15, supra, and text accompanying. 
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to know what information the credit bureau maintains on them, and the right to 
dispute errors. 

Consumer right to know. Under Section 609 of the FCRA, consumers have a right 
to know all information in their files (except risk scores) upon request and proper 
identification. They also have the right to learn the identity of all recipients of their 
report for the last year (2 years in employment cases)."^ In addition, the consumer’s 
right to learn about and dispute inaccuracies is facilitated by the FCRA’s “adverse 
action” notice requirements. Adverse action notices — sometimes called “Section 615 
notices” — are a key mechanism for maintaining accuracy. Since 1970, the FCRA has 
required that when credit is denied based, even in part, on a consumer report (or, 
in some cases, when the consumer is offered less-advantageous terms than would 
be the case in the absence of the consumer report information), the creditor must 
notify the consumer and provide certain key information, including (1) the identity 
of the consumer reporting agency from which the creditor obtained the report; (2) 
the right to obtain a free copy of the report; and (3) the right to dispute the accuracy 
of information in the report.’^® 

Under the 1970 FCRA, adverse action notices were required only when consumer 
reports were used for credit, insurance, or certain employment purposes. In the 1996 
Amendments, Congress broadened the circumstances under which adverse action 
notices are required in connection with insurance and employment decisions. It also 
required notices of adverse action when consumer reports are used in other situa- 
tions, such as opening savings or checking accounts, apartment rentals, and retail 
purchases by check.^® 

The Commission believes that the “self-help” mechanism embodied in the FCRA’s 
scheme of adverse action notices and the right to dispute is a critical component in 
the effort to maximize the accuracy of consumer reports. Consumers are most likely 
to recognize the errors in their credit history and are more highly motivated to raise 
their concerns once they know that an adverse action was based on their credit 
report. The Commission has given high priority to assuring compliance with this 
provision.''’^ 

Consumer dispute rights. The consumer initiates a dispute by notifying the con- 
sumer reporting agency of an error in the completeness or accuracy of any item of 
information contained in the file. The consumer reporting agency must reinvestigate 
the dispute, generally within 30 days, record the current status of the information 
and delete it if it is found to be inaccurate or unverifiable. The consumer reporting 
agency is required to provide “all relevant information” to the original furnisher of 
the disputed information, to help ensure that the furnisher fully investigates the 
dispute. The agency must report the results of the investigation to the consumer. 
If the investigation does not resolve the dispute, the consumer may file a statement 
with his or her version of the facts, which must then be furnished with the credit 
report. 

For the first time, the 1996 Amendments imposed certain accuracy and reinves- 
tigation duties on furnishers of information to credit bureaus. These requirements 
recognize that furnishers — the original source of the information — have a critical 
role to play in the overall accuracy of consumer report information. 

The 1996 Amendments also sought to address the problem of recurring errors by 
prohibiting consumer reporting agencies from reinserting into a consumer’s credit 
file previously deleted information without first obtaining a certification from the 


«15 U.S.C. §1681g. 

Section 612 provides that consumer reporting agencies must make free disclosure if a con- 
sumer makes a request within 60 days of receipt of an adverse action notice, and may charge 
a maximum of $8 in other cases. 15 U.S.C. §1681j. The Commission is charged in the FCRA 
with modifying the maximum amount, based proportionally on changes in the Consumer Price 
Index. The latest annual finding on the matter raised the maximum allowable charge to $9. 67 
Fed. Reg. 77282 (Dec. 17, 2002); see also http: I ! www.ftc.gov I opa ! 2002 j 12 j fyi0265.htm. 

^®In the original FCRA, adverse action notices were required only when “credit or insur- 
ance. . .or employment. . .is denied or the charge for such credit or insurance is increased. . ..” 
After changes enacted in the 1996 Amendments, adverse action for purposes of credit trans- 
actions is tied to the interpretation of “adverse action” in the Equal Credit Opportunity Act. For 
use of consumer reports in insurance, the scope of “adverse action” was expanded to include “a 
denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfa- 
vorable change in the terms of coverage or amount of, any insurance, existing or applied 
for. . ..” Similar expansion of the scope of “adverse action” was enacted for employment pur- 
poses (“a denial of employment or any other decision for employment purposes that adversely 
affects any current or prospective employee”) and other permissible purposes. See Section 603(k); 
15 U.S.C. 1681a(k). 

^'^See, e.g.. Quicken Loans Inc., D— 9304 (April 8, 2003) at Note 67, infra, and text accom- 
panying. 
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furnisher that the information is complete and accurate, and then notifying the con- 
sumer of the reinsertion. 

Other important FCRA provisions. Under the FCRA, adverse items of information 
may, with certain exceptions, be reported for only 7 years. The 1996 Amendments 
clarified the date from which the 7 years should be calculated. 

The 1996 Amendments expanded the obligations of certain users of consumer re- 
ports. In the employment context, these changes were quite significant; they include 
requirements that an employer obtain the consent of a job applicant or current em- 
ployee before obtaining a consumer report and, before taking adverse action based 
on the report, provide a copy of it to the individual.'^® 

The 1996 Amendments also made changes in the relationship between the FCRA 
and State laws. As originally enacted in 1970, the FCRA provided that the Federal 
statute did not exempt persons from complying with State laws “with respect to the 
collection, distribution, or use of any information on consumers, except to the extent 
that those laws are inconsistent” with the FCRA. The 1996 Amendments retained 
this language, but significantly modified the provision to preempt State laws in cer- 
tain specified areas covered by the amended FCRA."*^® 

Section 624 of the FCRA (“Relation to State Laws”) now provides that no State 
laws may be imposed in the areas of (i) prescreening (including the definition of the 
term “firm offer of credit or insurance” and the disclosures which must be made in 
connection with prescreened offers), (ii) the time within which a consumer reporting 
agency must complete its investigation of disputed information, (iii) the adverse ac- 
tion notice requirements of Section 615, (iv) the obsolescence limitations and other 
provisions of Section 605, (v) furnisher obligations under Section 623, (vi) the con- 
sumer summary of rights required by Section 609(c) to be provided by consumer- 
reporting agencies to consumers who obtain disclosure of their files, and (vii) infor- 
mation sharing by affiliates.®® The specific preemptions are qualified in a number 
of respects, including specifying particular preexisting State enactments to which 
the preemptions do not apply.®i The primary proviso with respect to the preempted 
provisions, however, is that after January 1, 2004, States may enact laws that (i) 
are specifically intended to supplement the FCRA, and (ii) give greater protection 
to consumers than is provided under the FCRA. 

Finally, other significant additions of the 1996 Amendments include authorizing 
States to enforce the FCRA, and adding civil penalty authority for the Federal 
Trade Commission. 

FTC Interpretive Guidance and Enforcement 

When it enacted the FCRA in 1970, Congress provided that the Commission 
would be the principal agency to enforce the statute. To help foster understanding 
and ensure compliance with the law, the Commission engaged in extensive business 
education and guidance, including, in the first two decades, publishing over 350 
staff opinion letters, a staff guidance handbook, and six formal Commission inter- 
pretations.®^ All of this material was then brought together in the Commission’s 
1990 Commentary on the FCRA.®® The Commentary was well received and has 


Because the new employer obligations imposed by the 1996 Amendments apply also to in- 
vestigative consumer reports and Congress removed a prior exemption for use of investigative 
reports in certain employment circumstances, employers may encounter difficulties when using 
outside entities to assist by preparing reports based on interviews in investigations of alleged 
workplace misconduct. Concerns arose because such investigations might be hampered by FCRA 
obligations, such as the requirement that an employer obtain the authorization of an employee 
before obtaining a consumer report, and the requirement that the employee be provided a copy 
of the report before the employer can take adverse action. Several Congressional proposals to 
amend the FCRA to meet the workplace investigation concerns have been introduced. In 2000, 
the Commission commented (see http:llwww.ftc.govlosl2000l03lltrpitofskysessiotis.htm) and 
testified with respect to one such proposal (see http: ! I www.ftc.gov I os 12000 ! 05 1 fcratest 
imony.htm). The Commission remains of the opinion that a legislative remedy of the type en- 
dorsed by the Commission in 2000 is the most appropriate response to these concerns. 

Thus, both before and after the 1996 preemptions. States were free to legislate in areas cov- 
ered by the FCRA but not specifically preempted. See. e.g., Colo. Rev. Stat. § 12-14.3-104 (pro- 
viding for free annual credit reports). 

so Section 624(b); 15 U.S.C. § 1681t(b). 

SI Section 624(d); 15 U.S.C. § 1681t(d). There is, moreover, a blanket “grandfathering” of State 
laws relating to the obsolescence limits of Section 605. Section 624(b)(1)(E); 15 U.S.C. 
§ 1681t(b)(l)(E). An example is N.Y. Gen. Bus. L. §380-j(f)(l)(ii)(paid judgments may not be re- 
ported for more than 5 years). 

s^The interpretations were published at 16 CFR §600 and were withdrawn when the Com- 
mission published the 1990 Commentary. 

S3 55 Fed. Reg. 18804 (May 4, 1990). The 1990 Commentary was the culmination of a proposal 
published in August 1988 and the Commission’s review of over 100 submissions it received in 
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served as a valuable explanatory and enforcement guide to industry and other 
affected parties. It also has assisted the staffs of the Commission and other regu- 
latory agencies in interpreting the Act efficiently and consistently. 

After the 1996 Amendments, the Commission intensified its long-standing pro- 
gram of consumer and industry education.®"* In view of the extension of enforcement 
authority to the States, the Commission conducted a nationwide series of training 
sessions on the FCRA for State officials. The Commission’s informal guidance ex- 
panded to meet the interpretive needs prompted by the amendments. As one result 
of that effort, the Commission staff published an additional 86 opinion letters. The 
letters can be found on the Commission’s website, which also features easy access 
to other useful FCRA information for both business and consumers.®® The Commis- 
sion and its staff maintain active participation in many industry and consumer out- 
reach efforts and respond daily to callers with FCRA questions.®® 

Current interpretive efforts at the Commission are focused on a revision to the 
1990 Commentary.^’’ The passage of time generally, and the 1996 Amendments spe- 
cifically, have rendered the 1990 Commentary partly obsolete. The new Commentary 
will draw on the staff opinion letters that post-dated the 1990 effort, as well as 
other Commission enforcement and interpretive experience. 

Over the entire period of the FCRA, the Commission has engaged in extensive 
consumer education.®® The Commission continues to regard consumer education as 
particularly vital to the FCRA because the statute contains self-enforcing elements, 
such as the right to dispute inaccurate or incomplete information. 

The Commission has also brought a number of formal actions to enforce the 
FCRA. These actions have included cases to ensure (1) compliance with the adverse 
action notice requirements on the part of creditors®® and employers;®® (2) compli- 
ance with privacy and accuracy requirements by the major nationwide credit bu- 
reaus; ®i (3) compliance by resellers of consumer reports (agencies that purchase 


response to its request for public comments on that proposal. 53 Fed. Reg. 29696 (August 8, 
1988). 

®*The Commission also drafted and published language for the three notices required by the 
1996 Amendments to be distributed by credit bureaus: (1) a notice to consumer report users of 
their FCRA responsibilities; (2) a notice to furnishers explaining their new obligations; and (3) 
a notice to consumers, describing their FCRA rights, which must be included with any credit 
report requested by the consumer. The Commission believes that Congress’ aim in requiring 
these notices has been achieved — the notices seem to be effective in conveying to consumers and 
businesses their rights and obligations under the Act. 

®®See, e.g., the Commission’s FCRA “home page,” http: ! Iwww.ftc.gov t os ! statutes t 
fcrajump.htm, and plain-English consumer information, http: ! t www.ftc.gov fbcp ! conlitie j 
edcams lfcralindex.html. 

®®To achieve compliance, the Commission has also periodically worked with industry and self- 
regulatory groups where appropriate. 

See Commission press release at http:! I www.ftc.gov t opal 2003 ! 01 1 fyi0302.htm, and “No- 
tice of intent to request public comments” at http: I / www.ftc.gov I os ! 2003 ] 01 ! 16cfrlfrn.htm. 

Over the past 7 years, 3.9 million of the five most popular FCRA brochures were distributed 
by the Commission. The information is duplicated on the Commission’s web site, where the 
same brochures have registered over 1.6 million visits during the past 5 years. FCRA brochures 
such as “Building a Better Credit Record,” “How to Dispute Credit Report Errors,” and “Fair 
Credit Reporting” have each been distributed in numbers exceeding 100,000 per year over the 
past 5 years. 

^^Hospital & Health Services Credit Union, 104 F.T.C. 589 (1984); Associated Dry Goods, 105 
F.T.C. 310 (1985); Wright-Patt Credit Union, 106 F.T.C. 354 (1985); Federated Department 
Stores, 106 F.T.C. 615 (1985); Winkleman Stores, Civ. No. C 85-2214 (N.D. Ohio 1985); 
Strawbridge and Clothier, Civ. No. 85—6855 (E.D. Pa. 1985); Green Tree Acceptance, Civ. No. 
CA 4 86 469 K (M.D. Tex. 1988); Quicken Loans Inc., D— 9304 (April 8, 2003). See also, Aristar, 
Civ. No. C-83-0719 (S. D. Fla. 1983); Allied Finance, Civ. No. CA3-85-1933F (N.D. Texas 
1985); Norwest Financial, Civ. No. 87 06025R (C.D. Cal. 1987); City Finance, Civ. No. l:90-cv- 
246-MHS (N.D. Ga. 1990); Tower Loan of Mississippi, Civ. No. J90-0447 (J) (S.D. Miss. 1990); 
Barclay American Corp., Civ. No. C-C— 91-0014-MU (N.C. 1991); Academic International, Civ. 
No. 91-CV-2738 (N.D. Ga. 1991); Bonlar, Civ. No. 97C 7274 (N.D. 111. 1997); Capital City Mort- 
gage, Civ. No. 1:98CV00237 (D.D.C. 1998). 

Electronic Data Systems, 114 F.T.C. 524 (1991); Kobacker, 115 F.T.C. 13 (1992); Keystone 
Carbon, 115 F.T.C. 22 (1992); McDonnell Douglas Corp., 115 F.T.C. 33 (1992); Macy’s, 115 
F.T.C. 43 (1992); Marshall-Field, 116 F.T.C. 777 (1993); Bruno’s, Inc., 124 F.T.C. 126 (1997); 
Aldi’s, 124 F.T.C. 1354 (1997); Altmeyer Home Stores, Inc., 125 F.T.C. 1295 (1998). 

B’^TransUnion Corp., 102 F.T.C. 1109 (1983); FTC v. TRW Inc., 784 F. Supp. 362 (N.D. Tex. 
1991); TransUnion Corp. 116 F.T.C. 1357 (1993)(consent settlement of prescreening issues only 
in 1992 target marketing complaint; see also TransUnion Corp. v. FTC, 81 F.3d 228 (D.C. Cir. 
1996) ); Equifax Credit Information Services, Inc., 130 F.T.C. 577 (1995). Each of these “omni- 
bus” orders differed in detail, but generally covered a variety of FCRA issues including accuracy, 
disclosure, permissible purposes, and prescreening. 
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consumer reports from the major bureaus and resell them);®^ as well as cases ad- 
dressing a number of other FCRA issues.®® 

The Commission’s enforcement efforts since 1996 have focused on the new 
requirements added by the amendments. For example, the amendments added a re- 
quirement that the nationwide credit bureaus have “personnel accessible” at toll- 
free numbers printed on a consumer’s credit report.®^ The Commission settled cases 
against the three major repositories charging that they failed to have adequate per- 
sonnel available to answer FCRA-mandated toll-free telephone numbers. The orders 
required the repositories to (1) maintain adequate personnel; (2) establish auditing 
requirements to ensure future compliance, and (3) pay a total $2.5 million in civil 
penalties.®® The Commission also has settled cases against furnishers of information 
to consumer reporting agencies alleging that they reported inaccurate dates for 
when consumers’ delinquencies had begun, with the result that adverse information 
remained on the consumers’ reports past the 7-year limit provided by the FCRA.®® 

Recently, the Commission settled an action against an Internet mortgage lender 
that failed to give adverse action notices to consumers who did not qualify for online 
preapproval because of information in their credit reports.®^ 

The Commission staff recently conducted an investigation of fifteen landlords in 
five cities across the United States. The staff found a high level of compliance with 
the adverse action requirements of the FCRA.®® To a significant degree, landlords 
do notify applicants when they turn them down for rentals based on information 
from a consumer report. The Commission will continue this type of compliance re- 
view in other industries, and bring law enforcement actions as appropriate. The 
Commission will continue to use this combination of education initiatives and vig- 
orous enforcement to foster compliance with the FCRA. 

Current Issues: The FCRA and the Expanded Use of Consumer Reports 

Based on the Commission’s experience interpreting and enforcing the FCRA, we 
see several ongoing developments in the consumer reporting marketplace that may 
have significant impact on consumers. First, more types of businesses are using 
credit reports to make decisions in consumer transactions. For example, telephone 
service providers routinely use consumer reports to make decisions on whether to 
provide service and what deposit requirements (if any) to impose. Insurance compa- 
nies have long considered consumer reports when underwriting homeowners and 
auto insurance policies. While insurers once looked primarily at consumers’ claims 
history to determine risk of loss, it appears that they are increasingly using infor- 
mation from consumers’ credit histories to make underwriting decisions.®® 


82 See I.R.S.C., 116 F.T.C. 266 (1993); CDB Infotek, 116 F.T.C. 280 (1993); Inter-Fact, Inc., 116 
F.T.C. 294 (1993); W.D.I.A., 117 F.T.CI. (1994)(consents against resellers settling allega- 

tions of failure to adequately ensure that users had permissible purposes to obtain the reports). 
See also First American Real Estate Solutions, LLC, C— 3849, January 27, 1999, 1999 FTC 
LEXIS 137 (consent with a reseller concerning the dispute obligations of consumer reporting 
agencies). 

^^Howard Enterprises 93 F.T.C. 909 (1979)(bad check lists); Equifax, Inc. (formerly Retail 
Credit Company), 96 F.T.C. 844 (1980)(investigative consumer reports);. MIB, Inc., d/b/a Medical 
Information Bureau, 101 F.T.C. 415 (1983)(prohibits a nonprofit medical reporting agency from 
conditioning the release of information to a consumer on his/her execution of a waiver of claims 
against the firm; requiring timely reinvestigations of disputed information; contact, when pos- 
sible, the source(s) of disputed information or other persons identified by the consumer who may 
possess information relevant to the challenged data and modify its files accordingly). 

8"^ Section 609(c)(1) of the FCRA, 15 U.S.C. § 1681g(c)(l), requires a consumer reporting agency 
that compiles and maintains files on consumers on a nationwide basis to establish a toll-free 
telephone number, at which personnel are accessible to consumers during normal business 
hours. This telephone number must be provided with each written disclosure of information in 
the consumer’s file, by the consumer reporting agency to the consumer. 

Equifax, No. l:00-CV-0087 (N.D. Ga. 2000); Experian, No. 3-00CV0056-L (N.D. Tex. 2000); 
TransUnion, OOC 0235 (N.D. 111. 2000). 

Credit Services, Inc., No. 02-5115 (C.D. Cal. 2002)(furnishing information to a consumer 
reporting agency knowing or consciously avoiding knowing that the information is inaccurate, 
failure to notify consumer reporting agencies when previously reported information is found to 
be inaccurate and to provide corrections, failure to provide accurate delinquency dates, failure 
to report accounts as “disputed” to consumer reporting agencies; $300,000 civil penalty); Per- 
formance Capital Management, Inc., 2:01cvl047 (C.D. Cal. 2000)(providing inaccurate delin- 
quency dates, failure to properly investigate disputes, failure to report accounts as “disputed” 
to consumer reporting agencies; $2 million civil penalty). 

Quicken Loans Inc., Docket No. D— 9304 (April 8, 2003); see also http: I Iwww.ftc.gov ! opa! 
2002 1 12 j quicken.htm. 

88 The Commission’s January 15, 2002 press release on the investigation and resulting busi- 
ness education brochure can be found at http:! / wivw.ftc.gov ! opa 1 2002 ! 01 1 fcraguide.htm. 

8® See, e.g., Sabrina Jones and Sandra Fleishman, “One Claim Too Many? Insurance’s New 
Policy: Use It and Lose It,” The Washington Post, November 10, 2002, at HOI; Dan Oldenburg, 
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Second, we are seeing new types of consumer credit providers and products in the 
marketplace. For example, the growing use of prescreened offers for marketing cred- 
it cards has led to the development of credit card hanks that rely almost entirely 
on prescreened offers to market their cards. Prescreening, in combination with 
other direct marketing and advertising, has led to the widespread availability of 
credit cards with no annual fee and other attractive benefits, and has enhanced 
competition.’^! Of course, some consumers may object to what may seem like a flood 
of prescreened offers in their mail boxes, or have concerns about the increased risk 
of identity theft that may occur in the same context. The 1996 Amendments to the 
FCRA allow these consumers to opt out of future offers. 

Third, businesses increasingly are using consumer report data to undertake risk- 
based pricing of products or services.!"^ In many areas, the decisionmaking of credi- 
tors and other businesses has moved away from a simple approval or denial model, 
and toward using consumer report data in a more finely calibrated evaluation of 
what terms to offer.'!^ Consumers whose credit histories warrant more favorable 
treatment benefit from access to products and terms that are more tailored by risk 
evaluations based on their actual performance. Consumers with poorer credit his- 
tories who in the past might have been turned down, may now qualify for credit, 
but on less favorable terms commensurate with the risk. Consumers benefit from 
a more efficient and competitive consumer credit market.'^'! 

Credit report scoring products are used in a variety of other contexts, including 
on-going monitoring and servicing of consumer accounts that can result in adjust- 
ments in terms, such as credit limits and finance changes. Rapid access to credit 
scores also permits retailers and others to offer “instant credit” to consumers. 

Overall, developments in the consumer credit marketplace have increased con- 
sumer choice and provided financial benefits to consumers. The Commission be- 
lieves that the growth of the consumer credit market has also increased public 
awareness and interest in credit reports and credit scores, and that the FCRA made 
this information more timely, accurate, and accessible. The consumer reporting sys- 
tem, and the obligations and protections of the FCRA, make it possible for creditors 
and other businesses to have access to timely, accurate consumer data. 

Any reference to the consumer reporting system should also recognize the increas- 
ing problem of identity theft. The range, accuracy, and timeliness of information in 
consumer reporting databases make them unique resources. They are therefore si- 
multaneously a target for identity thieves and a valuable resource for combating 
identity theft. Identity theft threatens the fair and efficient functioning of consumer 
credit markets by undermining the accuracy and credibility of the information flow 
that supports the markets. 

As I detailed recently before the House Financial Seryices Committee, the Com- 
mission is working actiyely to combat identity theft in a number of areas.!"® As 
awareness of the FTC’s role in identity theft has grown, businesses and organiza- 
tions who haye suffered compromises of personal information haye begun to contact 


“Car Insurers Take Credit Into Account,” The Washington Post, October 15, 2002, at CIO; Albert 
Crenshaw, “Bad Credit, Big Premiums; Insurers Using Bill-Payment History to Help Set Rates,” 
The Washington Post, June 18, 2002, at EOl. 

"^^See Fred H. Cate, Robert E. Litan, Michael Staten, and Peter Wallison, “Financial Privacy, 
Consumer Prosperity, and the Public Good: Maintaining the Balance,” AEI-Brookings Joint Cen- 
ter for Regulatory Studies, March 2003, at 11. 

“An Overview of Consumer Data and Credit Reporting,” Federal Reserve Bulletin, Feb- 
ruary 2003, at 72-73. See also Note 8 supra, and text accompanying. 

See also Fred H. Cate, Robert E. Litan, Michael Staten, and Peter Wallison, “Financial 
Privacy, Consumer Prosperity, and the Public Good: Maintaining the Balance,” AEI-Brookings 
Joint Center for Regulatory Studies, March 2003, at 12. 

"^^See, e.g., “An Overview of Consumer Data and Credit Reporting,” Federal Reserve Bulletin, 
February 2003, at 70 (“[consumer reportl data and the credit-scoring models derived from them 
have substantially improved the overall quality of credit decisions and have reduced the costs 
of such decisionmaking”), citing Gates, Perry and Zorn, “Automated Underwriting in Mortgage 
Lending: Good News for the Underserved?” Housing Policy Debate, vol. 13, issue 2, 2002, pp. 
369-91; and Barron and Staten, “The Value of Comprehensive Credit Reports: Lessons from the 
U.S. Experience,” Credit Research Center, Georgetown University, 2002. 

Some commentators suggest that using credit score cards built with data supplied by credit 
bureaus results in delinquency rates 20—30 percent lower than lending decisions based solely 
on judgmental evaluation of applications for credit. See Peter McCorkell, “The Impact of Credit 
Scoring and Automated Underwriting on Credit Availability,” in Thomas A. Durkin and Michael 
E. Staten, eds., The Impact of Public Policy on Consumer Credit (2002). 

"^^See, e.g., “An Overview of Consumer Data and Credit Reporting,” Federal Reserve Bulletin, 
February 2003, at 70; Fred H. Cate, Robert E. Litan, Michael Staten, and Peter Wallison, “Fi- 
nancial Privacy, Consumer Prosperity, and the Public Good: Maintaining the Balance,” AEI- 
Brookings Joint Center for Regulatory Studies, March 2003, passim. 

"^^See http:! ! financialservices.house.gov / media / pdfj 040303hb.pdf. 
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the FTC for assistance. For example, in the cases of TriWest^'^ and Ford/Experian,'^® 
in which massive numbers of individuals’ personal information was taken, the Com- 
mission provided advice on notifying those individuals and what steps they should 
take to protect themselves. From these experiences, the FTC developed a business 
record theft response kit that will be posted shortly on the identity theft website. 
The kit includes the steps to take in responding to an information compromise and 
a form letter for notifying the individuals whose information was taken. The kit pro- 
vides advice on the type of law enforcement agency to contact, depending on the 
type of compromise, business contact information for the three major credit report- 
ing agencies, suggestions for setting up an internal communication protocol, infor- 
mation about contacting the FTC for assistance, and a detailed explanation of what 
information individuals need to know. Organizations are encouraged to print and in- 
clude copies of Identity Theft: When Bad Things Happen to Your Good Name with 
the letter to individuals. 

Conclusion 

In 1970, Congress recognized that “consumer reporting agencies have assumed a 
vital role in assembling and evaluating consumer credit and other information on 
consumers.”'^® While Congress in 1970 may not have envisioned the specific ways 
in which consumer report information would facilitate the development of products 
and services that ultimately benefit the American consumer, the 33 years since pas- 
sage of the Act have fully demonstrated the wisdom of Congress in enacting the 
FCRA. 

The FCRA helps make possible the vitality of modern consumer credit markets. 
The consumer reporting industry, furnishers, and users can all rely on the uniform 
framework of the FCRA in what has become a complex, nationwide business of mak- 
ing consumer credit available to a diverse, mobile American public. 

The 1970 Act, along with the 1996 Amendments, provide a carefully balanced 
framework, making possible the benefits that result from the free, fair, and accurate 
flow of consumer data. All of these benefits depend on the consumer reporting sys- 
tem functioning as intended. That is why the Federal Trade Commission continues 
to emphasize the importance of educating consumers and businesses, and of enforc- 
ing the law to ensure compliance by all who have a role in making the system work. 


Adam Clymer, Officials Say Troops Risk Identity Theft After Burglary, The New York Times, 
Jan. 12, 2003, § 1 (Late Edition), at 12. 

Kathy M. Kristof and John J. Goldman, 3 Charged in Identity Theft Case, The Los Angeles 
Times, Nov. 6, 2002, Main News, Part 1 (Home Edition), at 1. 

™ Section 602(a)(3) of the FCRA. 
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RESPONSE TO WRITTEN QUESTIONS OF SENATOR CRAPO 
FROM J. HOWARD BEALES, III 

Q.l. Can you please describe whether prescreening increases con- 
sumers choice and lowers the cost of credit in traditionally under- 
served markets, such as rural areas that may have only one or two 
banks with a physical presence? 

A.l. Although I am aware of no hard data with respect specifically 
to benefits of prescreening for rural areas, there is evidence that 
greater competition in consumer credit (which includes the com- 
petitive benefits attributable to prescreening) has benefitted other 
underserved markets. For example, the percentage of minority fam- 
ilies with bank-type credit cards has more than doubled over the 
past 20 years, growing from 26 percent in 1983 to more than 54 
percent in 2001. ^ Certainly, given the overall increases in avail- 
ability of consumer credit and competitiveness in the market, it 
stands to reason that consumers who have more limited access to 
competing credit sources, whether it be in rural areas or even thin- 
ly served urban and suburban areas, would benefit from 
prescreened offers and other marketing innovations (such as Inter- 
net applications) that reduce the importance of convenient physical 
access in establishing a credit relationship. 

Q.2. How fair is the current system of consumer credit reporting? 
Is there evidence to suggest that any demographic segments have 
been subject to exclusion, predation, excessive costs, or other indi- 
cators of bias as a result of the pervasive use of credit scores and 
automated underwriting by consumer credit lenders? 

A.2. In the burgeoning of consumer credit during the mid-20th cen- 
tury, there was persistent evidence that judgmental credit sys- 
tems — that is, processes that depended upon individuals reviewing 
and deciding consumer applications for credit — resulted in discrimi- 
nation against protected classes.^ Credit scoring and automated 
underwriting work in significant ways to minimize the bias — inten- 
tional or incidental — that can be introduced into credit decisions in 
a judgmental system, because credit scoring models and automated 
underwriting systems are based on actual performance data, not 
assumptions about potential risk.^ There are significant market in- 
centives to create risk models that are the most predictive possible 
using available performance and other data. Because these data 
are objective and neutral, we believe that the current scoring sys- 
tems treat consumers more fairly. The significant expansion in 
credit availability to minorities that has been associated with the 
growth of credit scoring suggest scoring indeed has reduced bias. 

Q.3. Is there evidence that explains the major sources and causes 
of identity theft? Does this evidence point to the consumer credit 
information system? Do you have any data suggesting that 
prescreening is a major factor of identity theft: What about the 


1 See statement by Michael A. Turner before the House Committee on Financial Services, Sub- 
committee on Financial Institutions and Consumer Credit, May 8, 2003, http: ! I financial 
services.house.govlmedialpdfl050803mt.pdf at 4. 

^See, e.g., U.S. General Accounting Office Report, “Fair Lending” (August 1996); United States 
V. Shawmut Mortgage Company, Civ. No. 3:93CV-2453 AVC (D. Ct. 1993). 

^Development of scoring models has shown, for example, that criteria often relied upon in 
judgmental systems — the most frequently cited example is income — are not, in fact, predictive 
of future repayment risk. 
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point that FCRA and the smooth flow of information-sharing it pro- 
vides, helps financial institutions prevent and combat identity 
theft? 

A.3. From information provided by law enforcement, victim com- 
plaints, and news reports, we know a great deal about how identity 
theft happens and we can stay current with evolving methods. 
What we do not have is a statistical breakout showing which meth- 
ods contribute the most to identity theft. Because consumers’ infor- 
mation is accessible in a wide variety of situations, identity thieves 
can usually obtain it in a way that makes it difficult for victims 
to make a direct causal link. Thus, we have found that most vic- 
tims do not know how their information was obtained. Law enforce- 
ment agencies, as the investigators of the crimes, are often in a 
better position to know how the information was stolen in par- 
ticular instances. 

The consumer credit information system has undoubtedly been 
used as a source of information for identity theft; the Ford/ 
Experian case appears be the prime example. But, consumers’ per- 
sonal information is also used in universities, the health care 
system, all employment situations, and in a wide variety of Govern- 
ment programs from the Federal to the local level, and any survey 
of news articles in the last year can bring up examples of theft in 
all of these situations. As a result, the FTC places a premium on 
the importance of information security so that organizations that 
hold consumer information take appropriate steps to prevent this 
information from falling into the wrong hands.® 

To the extent that information does get into the wrong hands, 
the next opportunity to thwart identity thieves is at the point of 
commission of the fraud. Good authentication of credit applicants 
by credit issuers is the key. To that end, it is important that credit 
issuers know more about the real consumer than the identity thief. 
Information sharing is the means of providing credit issuers with 
this knowledge. However, this use of information only underscores 
again the importance of information security, to prevent identity 
thieves from accessing this same information in order to perfect 
their false identities. 

We have little evidence as to any links between prescreening and 
identity theft. To the extent that hard data exist, they suggest 
identity theft growing out of prescreened offers is somewhat lower 
than identity theft associated with conventionally opened ac- 
counts.® 

Q.4. In explaining the reasoning behind the broad preemptive lan- 
guage ultimately reflected in the 1996 Amendments to the FCRA, 
the Senate report on the matter states that “[tjhis section recog- 
nizes the fact that credit reporting and credit granting are, in 
many respects, national in scope, and that a single set of Federal 


^ Kathy M. Kristof and John J. Goldman, 3 Charged in Identity Theft Case, The Los Angeles 
Times, Nov. 6, 2002, Main News, Part 1 (Home Edition), at 1. 

®For example, last month the Commission’s settled charges with Guess?, Inc., and Guess.com, 
Inc. that the companies exposed consumers’ personal information, including credit card num- 
bers, to commonly known attacks by hackers, contrary to the companies’ promises. See http:! 
/ www.ftc.gov /os / 2003 / 06 1 guessagree.htm. 

^See, e.g., statement by Michael A. Turner before the House Committee on Financial Services, 
Subcommittee on Financial Institutions and Consumer Credit, May 8, 2003, http: II financial 
services.house.govlmedialpdfl050803mt.pdf, at 9-10. 
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rules promotes operational efficiency for industry, and competitive 
prices for consumers.” Please identify and address any develop- 
ments since 1996 rendering the statement by the Senate less rel- 
evant. 

A.4. I am not aware of any developments that would make these 
considerations less relevant today. Indeed, as the consumer credit 
system has become more national in scope, and given the continued 
mobility of the American consumer, these observations have con- 
tinuing validity. 

RESPONSE TO WRITTEN QUESTIONS OF SENATOR SARBANES 
FROM J. HOWARD BEALES, III 

Q.l. What are the typical consumer complaints regarding FCRA 
issues that the FTC receives on an everyday basis? What are the 
issues that arise most frequently? 

A.l. The FTC receives complaints directly from consumers through 
our toll-free hotline (877-FTC-HELP), our online complaint form 
{www.ftc.gov), or by mail sent directly to the Commission. The fol- 
lowing statistics regarding FCRA complaints are drawn from the 
Federal Trade Commission’s Consumer Information System (CIS) 
database, an aggregation of consumer complaints received by the 
Commission. FTC contractors enter the complaint data into the 
CIS, and provide the callers with information and educational ma- 
terial that will help them to resolve their complaint. Commission 
lawyers and investigators use the complaint database to identify 
trends and targets for law enforcement action. 

The statistics are derived solely from self-reported complaints, 
and have not been verified. All complaints are coded according to 
the information provided by the consumer, under the appropriate 
categories. FTC data analysts sort the data according to product/ 
service codes, which are generic categories for the complaints. The 
searches can be further defined by the statute or rule that is al- 
leged to have been violated, for example the Fair Credit Reporting 
Act (FCRA). Finally, the complaint can be further coded for the 
specific law violation, such as the failure to reinvestigate disputed 
information under the FCRA. Not all complaints are coded in all 
categories. For example, a complaint may be coded with a rule or 
statute, but not have a product/service code associated with it. 
Thus, complaints designated generally as FCRA complaints may 
include complaints about credit reporting agencies, credit report 
users, and information furnishers. The precision of the coding de- 
pends on the information provided by the consumer and the ability 
of the phone counselor or the consumer to enter that information 
precisely. 

In calendar year 2002, the total number of complaints reported 
directly to the FTC and entered into the CIS was 376,301. Of those, 
23,740 related to the FCRA (coded according to statute at issue in 
the complaint). The five top categories of complaints, among those 
coded as involving the FCRA, were “Provides Inaccurate Informa- 
tion” (13,188 complaints); “Fails to Reinvestigate Disputed Infor- 
mation” (3,030 complaints); “Knowingly Supplies Inaccurate Infor- 
mation to Credit Bureau” (2,486 complaints); “Provides Inadequate 
Phone Help” (1,614 complaints); and “Discloses Incomplete/Im- 
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proper Credit File to Consumer” (1,414 complaints). The complete 
report of FCRA complaints for 2002 is attached as Appendix A. 

In assessing the number and type of consumer complaints, it is 
also important to keep in mind several additional factors. First, 
there is no “typical” consumer complaint. There is a wide range of 
issues about which consumers contact the FTC. That said, the data 
consistently reflect accuracy and accuracy-related issues as a lead- 
ing area of complaint about credit bureaus. 

Not all complaints necessarily establish an FCRA violation. For 
example, some consumers, in an effort to “repair” their credit, file 
with credit bureaus multiple, repeated disputes of accurate infor- 
mation, and will sometimes complain to the Commission that the 
bureaus are rejecting their disputes. In fact, the bureaus are au- 
thorized under the FCRA to reject such “frivolous” disputes, and 
Commission staff likewise does not consider these complaints to re- 
flect FCRA violations. Other consumers file complaints because 
they have a mistaken belief that once a delinquency is brought up 
to date (a lien satisfied, collection account paid, etc.) the preceding 
record of past payment history is no longer reported; when they see 
it on their report, they dispute it as “inaccurate.” In this cir- 
cumstance, however, the FCRA requires that the consumer report 
be “complete” — that is, up to date, showing current status cor- 
rectly — ^but does not require the deletion of the preceding payment 
history. 

Although the Commission generally cannot make an independent 
judgment about whether each complaint (asserting inaccuracies, for 
example) is valid, we are concerned that complaints about accuracy 
continue to figure prominently. Accordingly, as discussed in the 
Commission’s testimony, the Commission’s FCRA enforcement ef- 
forts have included a number of actions related to accuracy issues.’^ 

Q.2. Are there any marketing abuses that fall within the subject 
matter of the FCRA that have been brought to your attention? 
Please include specific descriptions of any such abuses. 

A.2. I am currently aware of relatively few abuses associated with 
impermissible use of consumer reports for marketing. In the 1990’s, 
the Commission undertook enforcement efforts against major con- 
sumer reporting agencies to prohibit the use of consumer reports 


■^See TransUnion Corp., 102 FTC 1109 (1983); FTC v. TRW Inc., 784 F. Supp. 362 (N.D. Tex. 
1991); Equifax Credit Information Services, Inc., 130 FTC 577 (1995). Each of these “omnibus” 
orders differed in detail, but generally covered a variety of FCRA issues including accuracy, dis- 
closure, permissible purposes, and prescreening. 

Within the last 5 years, we have brought cases concerning the failure of CRA’s to investigate 
consumer complaints, see First American Real Estate Solutions, LLC, C— 3849 (January 27, 
1999); the failure of lenders to provide adverse action notices, see Quicken Loans Inc., D-9304 
(April 8, 2003) and U.S. v. Unicor Funding, Inc., Civ. No. 99—1228 (C.D. Cal. 1999); and the 
failure of furnishers to report accurate information to CRA’s, see U.S. v. DC Credit Services, Inc., 
Civ. No. 02-5115 (C.D. Cal. 2002) and U.S. v. Performance Capital Management, Inc., No. 01— 
1047 (C.D. Cal. 2001). We also have sued the three major national credit bureaus for failing 
to answer their toll-free telephones to take consumer disputes, see U.S. v. Equifax, No. 1:00- 
CV-0087 (N.D. Ga. 2000); U.S. v. Experian, No. 3-OOCV0056-L (N.D. Tex. 2000); U.S. v. 
TransUnion, OOC 0235 (N.D. 111. 2000), and just recently, the Commission settled allegations 
that Equifax violated the consent decree the Commission obtained in 2000, see Commission 
press release of July 30, 2003, available at ivww.ftc.gov I opa 1 2003 1 07 1 equifax.htm. All of these 
cases are directed at credit report accuracy: the adverse action notice and the consumer dispute 
right are key mechanisms enhancing credit report accuracy, and furnishers’ obligations to report 
accurate data to CRA’s also serve to make credit reports more accurate. 
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for target marketing.® More recently, in FTC v. Citigroup Inc., et 
ah, l:01-CV-00606-JTC (N.D. Ga. Mar. 6, 2001), the Commission 
alleged that a mortgage lender used consumer reports imper- 
missihly to target market new or different types of loans. We are 
also aware of complaints about some companies selling credit re- 
ports or credit monitoring services. These complaints allege inad- 
equate disclosure of the consumer’s negative-option right to cancel 
the service. 

Q.3. Many consumers complain about invasion of their privacy 
caused by unsolicited calls from telemarketers. Clearly, consumers 
have not gotten the message about the ways in which to terminate 
such unwanted solicitations. What does a consumer need to do to 
prevent such solicitations? How can that information be conveyed 
more effectively to consumers? Please include specific recommenda- 
tions as to how this information could best be conveyed. 

A.3. The Commission has amended the Telemarketing Sales Rule 
to give consumers a choice about whether they want to receive 
most telemarketing calls. ^ Consumers can now put their telephone 
numbers on a national “Do Not Call” registry. Consumers can reg- 
ister for free either online or by telephone. Telemarketers must ac- 
cess the national registry beginning September 11, and beginning 
October 1, it will be illegal for most telemarketers to call a number 
listed on the registry. 

Since the National “Do Not Call” registry opened on June 27 it 
has been immensely popular; nearly thirty million consumers have 
already signed on. The Commission is presently engaged in a vig- 
orous consumer education effort to further publicize the availability 
of the registry. 1° More generally, the Commission has undertaken 
comprehensive consumer education efforts in the privacy arena. 

The FCRA is relevant to telemarketing only to the degree that 
telemarketers obtain consumer names and telephone numbers from 
consumer reporting agencies for prescreened offers of credit or in- 
surance. When telemarketing lists are derived from FCRA-ap- 
proved prescreening, telephone solicitors are not required to give 
consumers notification of their right to opt out of future pre- 
screened solicitations because Congress limited the FCRA require- 
ment that consumers be notified of their opt out right to written 
prescreen offers. i® 


^FTC V. TRW, Inc., No. 3-31-CV266-H (N.D. Tex. Jan. 14, 1993); TransUnion Corp. v. FTC, 
81 F.3d 228, 234 (D.C. Cir. 1996). See also, TransUnion Corp. v. FTC, 245 F.3d 809, reh. denied 
267 F.3d 1138 (D.C. Cir. 2001), cert, denied, 122 S. Ct. 2386 (June 10, 2002). 

^ Concurrent with the Federal Trade Commission rule, the Federal Communications Commis- 
sion issued its own rule that requires banks, common carriers, and others to comply with DNC 
requirements, including using the FTC’s national registry. See http:llhraunfoss.fcc.govl 
edocs public / attachmatch / DOC-235841Al.doc. 

^^See, e.g., http:! I www.ftc.gov I bcp I coniine I edcams I donotcall I index.html. 

^^See, e.g., http:! I www.ftc.gov I bcp I coniine I pubs I credit I privchoices.htmi^yourright. 

The vast majority of prescreened solicitations are by mail. 

1^ Section 615(d)(1) of the FCRA requires that written solicitations include a “clear and con- 
spicuous” statement of certain information, including that the consumer’s credit report was used 
in the prescreen, various limitations on the offer, and disclosure of the consumer’s right to opt 
out of future prescreen solicitations. 15 U.S.C. § 1681m(d)(l). The Commission engaged in an 
enforcement action to assure that consumers are given disclosure of their opt out rights. In 
Unicor Funding, Inc. (October 1999), the Commission obtained a $100,000 civil penalty from 
Unicor for failing to provide required notices to consumers receiving “prescreened” offers 
[§ 615(d)], and failing to provide adverse action notices [§ 615(a)]. I am also aware of complaints 
that raise a question whether disclosure notices are sufficiently “clear and conspicuous.” The 

Continued 
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Whether they have received the written opt out disclosure or not, 
consumers can opt out of receiving prescreened offers by calling 1- 
888-567-8688. Once a consumer has opted out, his or her name 
cannot be supplied in a prescreened list for future offers, whether 
those offers are made in writing or by telephone. 

Q.4. If a consumer elects to opt out of such unwanted solicitations 
by contacting the credit reporting agencies by telephone, why is 
that opt out effective for only 2 years, whereas it is effective perma- 
nently, unless revoked, if done in writing? 

A.4. Congress created this distinction in the 1996 Amendments to 
the FCRA. For consumers who exercise their opt out rights under 
the FCRA, the 1996 Amendments provide that an opt out conveyed 
through the telephone notification system required by Section 
604(e)(5) should be effective for a 2-year period after notification, 
The 1996 Amendments further provided that, for a consumer who 
submits a signed notice of election to opt out in a form issued by 
the consumer reporting agency under Section 604(e)(2), the exclu- 
sion from prescreened lists shall be effective until revoked by the 
consumer. 

Q.5. Free credit reports are made available to consumers in several 
States, including Colorado, Georgia, Maryland, Massachusetts, 
New Jersey, and Vermont. What have been the results of this pro- 
vision with respect to the availability of credit in these States? Has 
the provision of free credit reports had an adverse impact on the 
credit system in these States? 

A.5. The FTC’s information to date on the comparative number of 
reports supplied to consumers is inconsistent. Some information in- 
dicates a mere marginal increase; other information indicates that 
the number of reports supplied to consumers nearly doubles. I am 
unaware of any data that demonstrate any impact from free avail- 
ability either on the availability of credit or on the credit systems 
of these States. 

Q.6. Very few consumers understand the prescreening process. 
Should the FTC establish standards within the FCRA that clearly 
delineate the prescreening process? 

A.6. The FCRA itself delineates the prescreening process in some 
detail, The Commission lacks rulemaking authority under the 


Commission has therefore endorsed Administration recommendations that the Commission and 
bank regulators be authorized to clarify and strengthen the opt out notice requirements. 

14 Section 604(e)(4)(B)(i); 15 U.S.C. § 1681b(e)(4)(B)(i). 

15 Section 604(e)(4)(B)(ii); 15 U.S.C. § 1681b(e)(4)(B)(ii). 

15 Sections 603(Z), 604(c), 604(e), and 615(d) of the FCRA codify procedures that must be fol- 
lowed by creditors and insurers when using (and by CRA’s when providing) consumer reports 
to make unsolicited offers of credit or insurance to consumers, a process known as “pre- 
screening.” Section 604(c) provides a limited permissible purpose for consumer reporting agen- 
cies to furnish consumer report information for prescreening. Section 603(/) defines a “firm offer 
of credit or insurance” as an offer that will be honored if a consumer meets the consumer report 
criteria used to create the list of consumers to receive the offer. Section 603(Z)(1) permits a busi- 
ness to use information in a consumer’s application (such as the consumer’s income) to deter- 
mine whether a consumer meets specific application criteria bearing on credit worthiness or in- 
surability so long as the criteria were established before the prescreened list was created. Sec- 
tion 603(/)(2) permits businesses to verify that a consumer continues to meet the credit worthi- 
ness or insurability criteria that were used in the prescreening to select the consumer to receive 
the solicitation, and permits businesses to also verify the application information provided by 
the consumer and used in any Section 603(/)(l) postscreening. Finally, Section 603(Z)(3) permits 
credit grantors and insurers to require that consumers furnish collateral so long as any required 
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FCRA, and thus cannot establish standards delineating the 
prescreening process. 

Q.7. What additional statutory or regulatory authority does the 
FTC need to effectively implement the FCRA? 

A.7. The Commission’s testimony on Thursday, July 10, set forth 
specific recommendations for additional FTC authority. 

RESPONSE TO WRITTEN QUESTIONS OF SENATOR BENNETT 
FROM J. HOWARD BEALES, III 

Q.l. Is credit prescreening simply a tool that makes it easier to 
market loan products to consumers? Some say that it serves other 
goals such as helping lenders reduce risk, increasing the avail- 
ability of consumer credit, or fostering competition among lenders. 
Please comment. 

A.l. I believe that prescreening, in combination with other direct 
marketing and advertising, has enhanced competition and led to 
the widespread availability of credit cards with no annual fee and 
other attractive benefits. For example, the use of prescreened of- 
fers for marketing credit cards has led to the development of credit 
card banks that rely almost entirely on prescreened offers to mar- 
ket their cards, There is also some evidence that prescreened of- 
fers help lenders manage risk, and do not contribute to identity 
theft — indeed, may even help prevent identity theft to some de- 
gree. 

Q.2. Expiration of the FCRA’s prescreening preemption language 
would allow States to prohibit prescreening, or require consumer 
reporting agencies or lenders to obtain the prior consent of the cus- 
tomer before their credit file could be accessed for prescreening. 
How would such requirements impact consumers? 

A.2. As explained above, prescreening benefits consumers by en- 
hancing competition. State restrictions on prescreening would 
interfere with these benefits. 

Q.3. Is there a linkage between prescreening and identity theft? 
Some say that prescreening increases consumers’ exposure by mak- 
ing it easier for lenders to flood consumers with preapproved appli- 
cations that can be stolen and submitted by identity thieves. Lend- 
ers say that prescreening reduces opportunities for identity theft, 
because it allows them to make smaller numbers of targeted offers 
rather than mail volumes of applications. They also claim that be- 
cause preapproved offers are preprinted with the consumer’s ad- 
dress and other information, it becomes easier to foil identity 
thieves when would-be identity thieves change the preprinted infor- 


collateral is established before the prescreening is conducted and is disclosed to the consumer 
in the solicitation that results from the prescreening. 

Section 604(e) sets forth consumers’ rights to opt out of prescreening, and CRAs’ duties to 
honor such opt outs. Section 615(d) sets forth duties of credit grantors and insurers when mak- 
ing prescreened offers. 

See also statement by Michael A. Turner before the House Committee on Financial Services, 
Subcommittee on Financial Institutions and Consumer Credit, May 8, 2003, http: II financial 
services.house.govlmedialpdfl050803mt.pdf at 7-9. 

^^See http: 1 1 www.senate.gov I -banking I files I bealesl.pdf at notes 70—71 and accompanying 

text. 

19 M at 9-10. 
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mation before submitting the application, changes that alert the 
lender to suspicious activity. What is the FTC’s experience? 

A.3. There is scant evidence of a linkage, one way or the other. To 
the extent that hard data exist, they suggest that identity theft 
growing out of prescreened offers is somewhat lower than identity 
theft associated with conventionally opened accounts.^o 

Q.4. What has the Commission’s experience been with regard to 
consumer complaints about prescreening? Describe the volume and 
subject matter of these complaints. 

A.4. The FTC’s consumer complaint database and the limitations 
of the information it provides is described above in response to Sen- 
ator Sarbanes. With respect to this inquiry, out of the 376,301 com- 
plaints received directly by the FTC in 2002, 39 concerned 
prescreening. Twenty-two of these stated that the prescreening bu- 
reau failed to honor the consumer’s request for removal from their 
list. Ten complaints concerned the failure of a prescreening service 
to provide notice of the opt out procedure. Four complaints con- 
cerned a prescreening service that failed to make a firm offer of 
credit, and three complaints alleged a false representation that an 
offer was preapproved. 

Q.5. Have State officials used their authority under the FCRA to 
enforce the FCRA’s prescreening provisions? What is the volume 
and nature of consumer complaints about credit prescreening that 
state officials have handled? 

A.5. Section 621(c)(2) of the FCRA requires States to serve prior 
written notice upon the Commission of intended State actions to 
enforce the FCRA. The Commission has received only one such no- 
tification from any State, and the case did not involve pre- 
screening.2i We know of no other case where a State has exercised 
its enforcement authority under the FCRA. Similarly, we have no 
information concerning consumer complaints at the State level, if 
any, about prescreening. 

Q.6. Does the FTC believe that changes are needed in the FCRA’s 
prescreening rules? Would consumers be affected differently if 
changes identified by the FTC or others are made by Congress, 
rather than by state or local officials? 

A.6. The Commission addressed these issues directly in its testi- 
mony on July 10. The Commission recommended that the preemp- 
tion of State action on prescreening be made permanent and that 
the Commission and bank regulators be granted rulemaking au- 
thority to address the prominence and understandability of disclo- 
sures to consumers of their right to opt out of prescreen offers. The 
Commission has not taken any position with respect to changes or 
amendments to the prescreening provisions of the FCRA. Any 
needed revisions to this or other sections of the FCRA that are sub- 
ject to preemption should be made by Congress and should apply 
uniformly. 


20 W. 

The Attorney General’s Office of the State of Minnesota charged US Bank with false adver- 
tising, deception, and other violations of Minnesota law, as well as FCRA counts. See Hatch v. 
US Bank Nat’l Ass’n, No. 99—872 (D. Minn, filed June 8, 1999). 
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RESPONSE TO WRITTEN QUESTIONS OF SENATOR MILLER 
FROM J. HOWARD BEALES, III 

Q.l. Mr. Beales, what is the FTC’s jurisdiction over the Fair Credit 
Reporting Act? Is it mainly education and guidance? Enforcement? 
Answering callers with FCRA questions or all of the above? 

A.l. The FTC has a role to play in each of these areas. The Com- 
mission’s jurisdiction under the FCRA reaches firms other than 
those expressly assigned to another Federal regulator, such as 
banks and savings associations. 22 Unlike the banking regulators, 
the Commission lacks rulemaking authority.^s Within those limits, 
the Commission has been active in all of the areas you identified. 
My testimony described many of the Agency’s efforts in consumer 
and industry education and guidance . ^4 The FTC continues aggres- 
sively to pursue ongoing consumer and business education initia- 
tives. The Agency continues to advance compliance with the 
FCRA, both through investigations of possible law violations and 
through informal means such as workshops, participation in public 
programs, and liaison with industry and other interested parties. 
The Agency has an active program to respond to telephone inquir- 
ies, through our Consumer Response Center described above and 
other avenues. 

Q.2. Based upon the daily callers with FCRA questions, what kinds 
of problems are they mostly asking about as it relates to the 
FCRA? Is there a trend? 

A.2. The FTC’s consumer complaint database and the limitations 
of the information it provides are described above in response to 
Senator Sarbanes. As noted there, the FTC received 376,301 com- 
plaints in 2002. The five top categories of complaints related to the 
FCRA were “Provides Inaccurate Information” (13,188 com- 
plaints);” Tails to Reinvestigate Disputed Information” (3,030 com- 
plaints); “Knowingly Supplies Inaccurate Information to Credit Bu- 
reau” (2,486 complaints); “Provides Inadequate Phone Help” (1614 
complaints); and “Discloses Incomplete/Improper Credit File to 
Consumer.” (1,414 complaints) The complete report of FCRA com- 
plaints is attached as Appendix A. 

Appendix B lists the number of FCRA complaints received by the 
FTC for the past 6 years. These data do not allow us to detect 
trends in FCRA issues. First, 1997 was the first year we began a 
systematic approach to complaint handling. With each passing 
year, we have improved our ability to collect and enter the data. 
For example, our phone counselors are more highly trained, and we 
are able to use technology to better handle and process calls. Thus, 
our complaint volume has increased. Similarly, over the course of 
this time, we have pursued an aggressive outreach program, which 
has resulted in higher awareness of the FTC’s consumer assistance 
program. Put another way, we receive more complaints because 
more people know about our consumer program. For example, in 


22 Section 621 of the FCRA, 15 U.S.C. § 1681s. 

23 Section 621(e) of the FCRA, 15 U.S.C. § 1681s(e). 

^‘^See http: I lwww.senate.gov I -banking I fileslbealesl.pdf at notes 52—58 and text accom- 

panying. 

See, e.g., the Commission’s recently posted alert regarding an email campaign containing 
false and misleading information about the use of consumers’ personal information, posted at 
http: ! I www.fte.gov Ibcp ! coniine ! pubs ! alerts ! optalrt.htm, and linked prominently on the Com- 
mission’s Internet home page, http:! Iwww.ftc.gov. 



68 


1997, the FTC received a total of 13,362 consumer complaints. By 
2002, as noted above, that number had grown to 376,301. Thus, 
while the data show a dramatic increase in the number of FCRA 
complaints over the past 6 years, there has also been a dramatic 
increase in the overall number of complaints received by the FTC 
during the same time period. As a fraction of total complaints we 
receive, FCRA complaints fell from 11.1 percent in 1997 to 3.5 per- 
cent in 2002. 

Finally, as discussed earlier, because this data is self-reported we 
cannot conclude that they reflect either the actual or a projectable 
incidence of FCRA violations. 

Despite the various considerations that preclude explicit conclu- 
sions from the numbers and types of complaints alone, the most 
common subject areas of consumer complaints (accuracy, reappear- 
ance of previously deleted items) have typically led the list of sub- 
ject areas complained of over the years. 

Q.3. Will your updated Commentary that you are working on re- 
flect the more recent problems raised by callers? 

A.3. The Commentary is intended to give guidance to all parties 
who are subject to the requirements of the FCRA. The Com- 
mentary will reflect a wide range of Commission experience in en- 
forcing the FCRA. Additionally, the Commission staff undertook an 
informal outreach effort prior to drafting the updated Commentary. 
The staff received views from a variety of sources, including con- 
sumer groups, consumer advocates, trade groups, and industry and 
public interest lawyers. 

Q.4. Of the seven 1996 preemption amendments to the FCRA, 
which ones have callers raised the most issues with? Have there 
been any problems with the treatment of affiliate information shar- 
ing? 

A.4. Consumers have not typically complained about areas subject 
to the preemptions in ways that implicate any issue relevant to 
preemption itself. We are aware of no complaints regarding the 
treatment of information sharing by affiliates. 



THE GROWING PROBLEM OF 
IDENTITY THEFT AND ITS RELATIONSHIP 
TO THE FAIR CREDIT REPORTING ACT 


THURSDAY, JUNE 19, 2003 

U.S. Senate, 

Committee on Banking, Housing, and Urban Affairs, 

Washington, DC. 

The Committee met at 10:02 a.m., in room SD-538, Dirksen Sen- 
ate Office Building, Senator Richard C. Shelby (Chairman of the 
Committee) presiding. 

OPENING STATEMENT OF CHAIRMAN RICHARD C. SHELBY 

Chairman Shelby. The Committee will come to order. 

Today, the Committee returns to considering the expiring pre- 
emption provisions of the Fair Credit Reporting Act. As part of this 
process, I believe it is essential that we undertake a thorough re- 
view of the larger context in which the Act operates. And, in this 
regard, the first thing worth noting is the truly dynamic nature of 
the credit markets in our economy. In just the 6 years since the 
Fair Credit Reporting Act was last amended, significant changes 
have occurred. There are new participants, new technologies, new 
information use practices, and new products. Indeed, there is more 
that has changed than has remained the same in the operation of 
the credit markets since the last time Congress considered the Fair 
Credit Reporting Act. 

While many of these changes introduced positive features, such 
as more credit and an expedited process for obtaining credit, not 
every new development has been positive. Unfortunately, as our 
economy has grown more automated, allowing more and more de- 
personalized transactions to occur, and, as the transfer of person- 
ally identifiable information has become much more frequent, a 
new type of crime that takes advantage of these circumstances has 
emerged — identity theft. 

Identity theft involves a person using someone else’s personal 
information without their knowledge to commit fraud or theft. 
Practically speaking, the crime involves misappropriation of such 
personal information as a victim’s name, date of birth, and Social 
Security number. Identity thieves then use this information to open 
new credit card accounts, to divert current accounts from victims 
to themselves, and to open bank accounts in victims’ names, among 
other things. The bad charges and the hot checks usually happen 
while the victims, banks, credit card companies, and other firms 
are unaware that something is amiss. After all the activity and the 

( 69 ) 
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skipped payments, businesses usually take action to get compen- 
sated and ultimately cut the thief off. 

In most instances, this is when the victims first become aware 
of the fact that they have been targeted. It is also when they begin 
to experience the negative consequences — dealing with law enforce- 
ment and collection agencies. Soon thereafter, when the criminals’ 
handiwork shows up on their credit reports, they face the consider- 
able task of restoring their good name and credit. Plainly, this 
crime has many victims. Firms lose profits. Individuals lose time, 
money, and peace of mind when their good name and reputation 
are tarnished. 

In light of the serious nature of the consequences of identity 
theft, this issue would merit attention even if there were only a 
limited number of victims. Unfortunately, there are thousands of 
victims whose numbers are growing at an increasingly faster pace. 
Indeed, it has been asserted that identity theft is the fastest grow- 
ing crime in America. 

This issue tracks across credit reporting in so many ways that 
it is essential that we consider it in the context of the reauthoriza- 
tion of the preemption provisions of the Fair Credit Reporting Act. 

Identity theft prevention, restoration of accurate reports, and vic- 
tim assistance, among many other areas, are things that were not 
on the radar screen when the 1996 Amendments were passed into 
law. These are things we need to be thinking about as we go for- 
ward, things we must be considering if we are going to meet our 
goal of ensuring that the law produces the most effective, efficient, 
balanced, and fair system possible. 

I want to thank the witnesses for appearing this morning andwe 
look forward to hearing from them. 

Senator Johnson. 

STATEMENT OF SENATOR TIM JOHNSON 

Senator Johnson. Thank you. Chairman Shelby, for convening 
this hearing on identity theft. Identity theft is a growing problem 
and yet one that is not well understood. While most people know 
where to go in the case of more traditional crimes, victims of iden- 
tity theft are particularly hard-pressed to know where to turn. A 
call to the local police department, unfortunately, rarely points the 
consumer in the right direction. 

Clearly, we need to create a framework to address identity theft. 
Back in 1995, when Sandra Bullock starred in “The Net,” a feature 
film about identity theft, the movie was classified as science fiction. 
After reading the testimony of the witnesses before us today, I 
think it is clear that we must confront the reality of this crime. 

Today’s hearing is on the relationship between identity theft and 
the Fair Credit Reporting Act, and, Mr. Chairman, I believe this 
is an important hearing. As we know, our credit reporting system 
has created a national credit marketplace, and I think that we are 
all familiar with the enormous benefits that come from increased 
credit opportunities. However, a national marketplace has created 
new opportunities for remote economic crimes where the thief can 
be thousands of miles away from the location of the victim. 

A couple of days ago. Assistant Secretary of the Treasury Wayne 
A. Abernathy, who is well-known to many of us here for his long 
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service as Committee Staff Director under Senator Phil Gramm, 
said something in a speech that struck a chord with me. He noted 
that identity theft is not a problem of too much information. It is 
a problem of too little information. And by this, he meant that 
identity theft happens when creditors lack the necessary informa- 
tion to assess the credibility of an applicant. 

It is often argued that a uniform national credit system is our 
best tool in the fight against identity theft, and in some sense, Mr. 
Harrison, who will testify before the panel today, confirms this by 
describing the additional problems he encountered in trying to sort 
out fraud related to his checking account where no centralized sys- 
tem similar to the Big Three credit bureaus is in place. 

On the other hand, I am deeply troubled by the apparent conflict 
between Mr. Harrison’s written testimony and the claims that the 
credit bureaus and national credit system are the answer to iden- 
tity theft. He appears to have done absolutely everything right, fol- 
lowed all the rules, contacted the right organizations, and the 
results have, nevertheless, been devastating. I am also troubled by 
reports that even when a consumer takes the time to put a fraud 
alert on his or her account, those alerts may sometimes be ignored. 

So, I want to make it perfectly clear that I continue to believe 
that a single national system provides a critical opportunity to 
address identity theft. And yet we have a responsibility to the hun- 
dreds of thousands of victims of identity theft to make sure that 
we fine-tune our system so that it does not take years to correct 
a credit record. That is wrong, and that is not what Congress in- 
tended. 

What I think is most important, though, is that we do not make 
FCRA the straw man for identity theft. The worst thing we can do 
is jeopardize millions of Americans’ access to credit so we can claim 
to have done something about this terrible crime. 

So, Mr. Chairman, I look forward to hearing today’s witnesses, 
and I thank you once again for holding this hearing. 

Chairman Shelby. Thank you. Senator Johnson. 

Senator Dole. 

STATEMENT OF SENATOR ELIZABETH DOLE 

Senator Dole. Mr. Chairman, I want to thank you for holding 
this hearing today on identity theft and its relationship to the Fair 
Credit Reporting Act. Identity theft, as you mentioned, is fre- 
quently cited as the fastest growing crime in the Nation. However, 
precise statistics are not available to properly gauge the full extent 
of the problem since an estimated 40 percent of identity theft cases 
are believed to involve friends or family members and are never 
reported. 

Identity theft is a problem that has grown increasingly more 
prevalent in the past few years. According to the Federal Trade 
Commission, my alma mater, identity theft was the top consumer 
complaint received last year, with the rate of complaints and in- 
quiries increasing at an alarming rate with the widespread use of 
Internet technology. There are currently over 1,700 cases of stolen 
identity per week that are being reported. 

Fighting fraud and protecting the security of personal informa- 
tion is a topic that unites financial institutions and consumers. 
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Each group is harmed hy fraudulent use of personal information. 
Financial institutions are the victims of fraud because the financial 
institution is usually liable for any losses suffered as a result of the 
fraud. Consumers obviously suffer unnecessary inconvenience and 
insecurity as a result of fraud, and they can be exposed to addi- 
tional crimes such as identity theft. Furthermore, at least a portion 
of financial institutions’ fraud losses can be expected to be passed 
on to consumers in the form of higher prices. There can be no doubt 
that when fraud is committed, everyone loses. 

With the December 31 expiration of important provisions of the 
Fair Credit Reporting Act, we have the responsibility to examine 
problems within the system that have been harming both con- 
sumers and financial institutions. It is my hope that in addition to 
reauthorizing the Fair Credit Reporting Act, we can take strong 
steps toward combatting and preventing identity theft. 

I certainly want to thank our witnesses for joining us here today. 
I look forward to working with my colleagues to address the prob- 
lem of identity theft in our work to reauthorize the Fair Credit Re- 
porting Act this year. 

Thank you. 

Chairman Shelby. Thank you. Senator Dole. 

Senator Corzine. 

STATEMENT OF SENATOR JON S. CORZINE 

Senator Corzine. Thank you, Mr. Chairman, and I commend you 
for holding this hearing. I welcome our witnesses and look forward 
to hearing their testimony and responses to questions. 

This is an important juxtaposition, the Fair Credit Reporting Act 
and identity theft, which is one of the many issues that we need 
to address here. Identity theft, I think, plays a central role, if not 
vital part, in this reauthorization, which I fully support. I think 
this problem has been acknowledged by just about everyone — con- 
sumers and most financial institutions and others who look at it 
from a law enforcement standpoint — that there is a real stake that 
we need to address inside the concept of FCRA. And I think every- 
one acknowledges that identity theft is one of the single largest 
sources of consumer-related problems that the FTC deals with on 
a regular basis. 

The numbers bear that out. According to the FTC, reported in- 
stances of identity theft rose phenomenally, 88 percent in 2002, to 
380,000 from 220,000 in 2001. And almost everyone acknowledges 
those numbers understate the reality of the problem that exists. 
The costs are staggering. Out-of-pocket costs for victims of identity 
theft skyrocketed from $160 million in 2001 to $343 million last 
year. Those are numbers that are based on reported elements. 

I can tell you that in New Jersey there have been multiple in- 
stances of organized crime-related elements involved in identity 
theft as well as the individual consumer being put at risk, several 
rings that worked up and down the East Coast, and it is actually 
quite a recognized concern of consumers in my community. 

Simply put, our consumers are losing the battle against identity 
thieves, and when they lose, I think we all lose in our economy. 
And I think all of us know that about 70 percent of our economy 
is driven by consumers. 
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While Congress has taken some important steps in this area, 
most notably by making it a Federal crime in 1998, some individ- 
uals in financial services have taken voluntary initiatives — the 
truncating of credit card numbers, for instance, which I commend. 
I think there is more that can be done. 

Next week, I plan on introducing legislation to address the prob- 
lem of identity theft. The Identity Theft Notification and Credit 
Restoration Act is based on three key principles — disclosure, pre- 
vention, and credit restoration. By the way, I hope to be able to 
work with others in refining this and making it meet the needs of 
what, I think, is a major problem in our Nation. 

First, it requires financial institutions to make timely disclosures 
to individuals, credit reporting agencies, and law enforcement when 
their information has been breached, either computerized or paper 
records, and compromises that personal information of those finan- 
cial institutions’ customers. 

Second, the bill requires credit reporting agencies, upon notifica- 
tion of the breach, to place “fraud alerts” in the credit files of 
affected individuals. This red flag will alert issuers of credit to un- 
dertake enhanced preauthorization procedures prior to issuing 
credit in the name of the individual who has a fraud alert on their 
credit file. 

Finally, the bill provides victims of identity theft with access to 
four credit reports the year following the theft of their identity to 
ensure that inaccurate and credit damaging information resulting 
from the identity theft does not end up on their credit file, ruining 
their ability to operate in our economic system. The bill improves 
the ability of all consumers to monitor the content and accuracy of 
the information contained in their individual credit file by pro- 
viding them with access to one free credit report per year. 

Mr. Chairman, many, including some of the witnesses here, have 
articulated that one of the best ways to fight identity theft is by 
empowering consumers with more information and greater aware- 
ness of the risks and that this problem is growing. I think the bill 
that I am suggesting will do just that. 

I look forward to working with you and the other Members of the 
Committee with regard to this very important issue. 

Chairman Shelby. Thank you. Senator Corzine. 

Senator Crapo. 

STATEMENT OF SENATOR MIKE CRAPO 

Senator Crapo. Thank you, Mr. Chairman. I, too, want to thank 
you for holding this hearing. 

As I am sure everyone here knows, the Fair Credit Reporting Act 
and the issues that surround it are going to be very central to the 
activity of this Committee this year and critical to our efforts to 
make sure that the proper protection of our credit system in this 
country is accomplished. And part of that is going to be addressing 
the question of identity theft. 

I suspect that that may be one of the easier parts that we ad- 
dress because it may be one where we find the most consensus 
among us as to whether there is an issue and how to approach it. 
But, nonetheless, it will be one of the more important aspects of 
what we do. 
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This last weekend, I happened to be in a hotel, and late at night 
I was flipping through channels, and it is interesting that Senator 
Johnson mentioned Sandra Bullock in “The Net” because, lo and 
behold, there it was on television. And at the time, I wondered, if 
the media is picking up on the issue of identity theft by either no- 
ticing what we are doing in Congress and following our lead, or 
whether we are following their lead and they are bringing the 
public’s attention to it. Then I wondered perhaps it was just a coin- 
cidence, but I doubt it. 

The fact is that across this country, whether it is here in Con- 
gress, among the consuming public, or in financial institutions, 
identity theft is becoming an increasingly large issue. I think as we 
approach the issue, we want to make certain that we do it in the 
context of recognizing the value of our system of credit in this coun- 
try today, and not blaming our system of credit but recognizing 
that the strength of the Fair Credit Reporting Act and what we 
have in America in terms of the way we approach and manage 
credit is a strong part of our system that needs to be protected and 
that can be used as the system by which we achieve the objectives 
to protect against identity theft. 

It seems to me that the Fair Credit Reporting Act and our credit 
system in this country is a big part of the solution, not a part of 
the problem that we are facing here. And I look forward to working 
with the other Members of the Committee on this issue. I, too, am 
putting together an approach to this issue legislatively, and I look 
forward to working with Senator Corzine and others who are going 
to be addressing this because it will be one piece of a very big part 
of our approach to the credit system of our country this year that 
is critical to consumers, financial institutions, and, frankly, to the 
strength of our economy. 

Thank you. 

Chairman Shelby. Thank you. Senator Crapo. 

Senator Dodd. 

STATEMENT OF SENATOR CHRISTOPHER J. DODD 

Senator Dodd. Thank you very much, Mr. Chairman, not only for 
holding this hearing, but also for your leadership on this issue. I 
have enjoyed working with the distinguished Chairman of this 
Committee on issues involving privacy for a long time, and I am 
grateful, along with others here. But the people who may be most 
grateful are the ones who are not sitting on this panel but others 
out there, and you are going to hear from some of them today. 
Some witnesses have been through almost Kafka-esque situations 
in terms of their credit problems and the like. 

You are going to hear from a constituent of mine. Captain John 
Harrison, retired from the U.S. Army, a story that will be hard for 
you even to imagine what he has gone through, but rather remark- 
able what has happened to him and others. So, I thank you very, 
very much. 

Just to share a couple of thoughts, identity theft is a matter, ob- 
viously, of great concern to consumers across the country, and it is 
clear to me that we have to do more to help consumers safeguard 
their financial and personal identities. Being financially secure 
used to mean, in the United States, that you had enough money 
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in the bank to see you through a rainy day. Unfortunately, today 
being financially secure has another meaning as well. It means 
that you have the ability to stop the improper use of your financial 
records, and you have the power to prevent misuse of your name, 
your financial history, and your good reputation. 

I understand that there are more than 1,300 identity theft vic- 
tims in my State alone, a small State, 3.5 million people each year. 
As the story you will hear from Captain Harrison will attest, iden- 
tity theft can have devastating consequences on the personal and 
professional lives of its victims. For those who have been caught in 
the tangled web of other people’s lies, the need for reforming the 
financial system so that it can better respond to identity fraud is 
perfectly clear. I want to publicly thank Captain Harrison. It is not 
easy. It is hard enough to go through what he has been through, 
but now to come to a public place and talk about what happened 
to you requires a certain amount of courage. And I admire people 
who are willing to do that, to stand before us and tell us what has 
happened to them. 

I also want to thank Mike Naylor, Mr. Chairman, and thank you 
for asking him to be a witness here today. Mike works with AARP 
and has done some excellent work in identifying possible solutions 
to the current identity fraud problem. And for truth in advertising, 
Mike Naylor is my former Legislative Director, many, many years 
ago. He has been in the private sector for a lot of years and just 
recently joined AARP. But I think you will find his testimony 
worthwhile. 

In my view, consumers should be able to seek financial services 
without fear. Consumers should be able to rest assured that their 
private financial information will be responsibly maintained by 
those who have been entrusted with that information. Companies 
that collect consumer financial information must be able to respon- 
sibly handle that information, and such information should not be 
negligently published or even intentionally shared without con- 
sumers’ consent. 

Furthermore, consumers should not only have the right to know 
how their personal financial information is being used, but should 
also have the right to say no to sharing that information. 

In recent years, we have taken steps to empower consumers with 
control over their own financial information. The Financial Services 
Modernization Act, also known as Gramm-Leach-Bliley, for exam- 
ple, enhanced consumer protections and for the very first time 
made financial institutions accountable for notifying consumers 
about their right to opt out of sharing nonpublic, personally identi- 
fiable information with nonaffiliated third parties. 

The Gramm-Leach-Bliley Act requires financial institutions to 
notify consumers of their privacy policies and any plans to share 
personal information with another party. And while these safe- 
guards are an important step toward ensuring consumers’ financial 
security, I believe much more must be done to afford consumers 
greater control over their own financial privacy. 

Let me also underscore the point that our colleague from Idaho, 
Senator Crapo, has made. I think it is also the balanced side of this 
thing. The credit system has worked tremendously well to ensure 
us a strong economy in this country, and striking the balance here 
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is not easy to do, but it must be done. And I think we can do that. 
It is going to be a challenge for this Committee. 

Mr. Chairman, thank you immensely for holding these hearings. 

Chairman Shelby. Thank you. 

Senator Allard. 

STATEMENT OF SENATOR WAYNE ALLARD 

Senator Allard. Mr. Chairman, I, like many of my colleagues on 
this Committee, want to thank you for your diligence on this par- 
ticular issue, both for holding today’s hearing as well as your sup- 
port for improvement of the Fair Credit Reporting Act. While 
national statistics tend to focus on crimes such as homicides and 
burglaries and robberies, the crime of stealing one’s identity is a 
serious and widespread crime that too often goes overlooked. Iden- 
tity theft takes advantage of hard-working citizens in a situation 
they simply cannot prevent. Many of these hard-working citizens, 
Mr. Chairman, will not even realize that they have been a victim 
of identity theft until they go to apply for a car loan or a loan for 
their home. Then suddenly they discover that for some reason or 
another, they do not qualify. 

This is almost a subject for another hearing, but part of the prob- 
lem is that on credit scores, for example, a lot of consumers do not 
even realize that there is a system out there that has an impact 
on their credit ratings. This system is based on how frequently a 
credit card is used; how many credit cards one has; how many in- 
quiries there are on your name. All of these actions have an impact 
on one’s credit. So why should we worry about it? Well, it has an 
impact on the interest rate that you might pay on a loan, so there 
is a hidden cost associated with this system. 

If you talk to victims, there are also issues as far as legal juris- 
diction, and which law enforcement agency is responsible for en- 
forcing certain laws pertaining to identity theft. This may need to 
be covered in another committee, but it is something this Com- 
mittee should think about. 

The other important question that comes up: Are our penalties 
tough enough? When you look at what happens to a victim of some- 
thing like this, I think the question that we need to ask is: Are the 
penalties tough enough for the perpetrators? 

And so, Mr. President — Mr. Chairman, I hope that you continue 
to hold hearings on this important issue. 

Chairman Shelby. I support President Bush. 

Senator Allard. Yes, sorry about that, Mr. Chairman. 

[Laughter.] 

Senator Allard. I think we need to look at a number of different 
cases to fully understand this problem. The bottom line is that of 
the more than one million inquiries that the Federal Trade Com- 
mission received in 2001, 86,680 of them were identity fraud com- 
plaints. This presents a grave situation for unsuspecting Americans 
and a challenge for all financial institutions and businesses in the 
United States. 

While there is an apparent need to protect sensitive personal in- 
formation from getting into the wrong hands, there is also a need 
for a certain degree of transparency in order for the U.S. financial 
and business systems to function. 
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I would like to thank the witnesses for agreeing to testify today 
on this important issue, and I look forward to all of your testimony. 

Chairman Shelby. Thank you, Senator Allard. 

Senator Schumer. 

STATEMENT OF SENATOR CHARLES E. SCHUMER 

Senator Schumer. Thank you, Mr. Chairman, and thank you for 
holding this hearing. 

Again, this is a really important issue. I have been concerned 
and involved in it for over a year, and there is nothing worse than 
when your identity is stolen through no fault of your own and then 
it takes you years and years to restore your credit rating. It is an 
impossible situation. And it used to be a small situation. You know, 
this was not done en masse before the days of computers. Some- 
body might reach into a garbage can and find somebody’s credit 
card number and do it. But we have had instances in New York 
where whole databases were stolen by employees selling for 30 
bucks an identity or something like that and making huge amounts 
of money. Our U.S. Attorney, Mr. Comey, had a major indictment 
of this. 

So, I certainly agree with what some of my colleagues have said, 
I think Mike Crapo, that our credit system and this new digital age 
have brought huge benefits. It also brings some liabilities, and it 
is our job to focus on those liabilities, and I think FCRA is an ap- 
propriate place to do it. 

As I mentioned, Mr. Chairman, this issue is of specific concern 
to New York. The city where I live, my hometown, has the unfortu- 
nate distinction of being the identity theft capital of the United 
States. We suffer more identity theft than any other place. My 
State, New York, has the second highest amount. And this is 
mushrooming. 

Last year, the FTC nationally received twice as many complaints 
about identity theft as in 2001. Many people predict that by 2006 
there are going to be half a million to 700,000 Americans victim- 
ized. And this is not just a casual thing. It changes your life. You 
cannot get credit. Some people hound you. It is a huge mess. 

So, I think we have to move, and we have to move quickly. When 
you destroy a person’s credit rating, you not only jeopardize an 
honest person’s ability to get a credit card, receive approval for a 
loan, obviously, but also to get a job, or to buy a house. Those are 
ones that go to the core of who each of us are and what matters 
to us in our lives. 

We should do a number of things, and like some others here, I 
have a proposal that I have been floating and circulating. Before 
I do that, I do want to mention a couple of other people who have 
had — Senator Cantwell has a bill that I have cosponsored that 
makes it easier to restore your rating once it has been stolen. And 
in the Judiciary Committee, we are working together with Senator 
Feinstein in terms of toughening up the penalties. But there are 
five or six things I would recommend to this Committee to look at. 

One is to make sure that the credit databases are much more se- 
cure. You do that in a few ways. You make sure that the people 
who have access to those credit databases are bona fide people; 
make sure they do not have a criminal record; make sure they have 
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had no other bad histories in the past. All too many companies do 
not do that now. Two, let people go into those — even the employees 
go into those credit databases on a need-to-know basis. Most of the 
companies we found, including the big case in New York which af- 
fected people throughout the country, any employee could just 
punch in and get the whole database, whether they needed it for 
their job or not. And so the credit companies should do this on a 
need-to-know basis. Let the employees go in there on a need-to- 
know basis. So those two things are important. 

At the core of the proposal I have made is credit account notifica- 
tion. Credit reporting agencies should notify a consumer when a 
new credit account is opened in his or her name because we know 
what happens. They take your name, they take your birth date, 
they take your Social Security number, and they just put in a dif- 
ferent address. If the minute, you know. Chuck Schumer, 05 — I 
should not use my Social Security number — Chuck Schumer, Social 
Security number, 123-45-6789, birth date, January 1, 2001 — make 
myself a little younger. But the minute that happens, and someone 
opens up a credit card at a new address, they should immediately 
send a notification to my old address where I really live, and I 
would say, hey, I did not move to Evanston, Illinois. And you could 
stop a whole lot of identity theft with that simple notification provi- 
sion. I think we should do that. 

And two other things, Mr. Chairman. I am sorry. I appreciate the 
indulgence. We should truncate credit card receipts. Some compa- 
nies do this. In other words, the receipt, the part you discard, does 
not show the whole number on there so people cannot go into the 
garbage can, pick it up, and duplicate your credit card number. 
That is easy to do, and some companies have it and some do not. 

Finally, as I mentioned earlier — Senator Cantwell has worked on 
this — make it easier if once it is proven bona fide that you are a 
victim of identity theft, make it easier to get your financial life 
back because that is a real hard thing to do. 

So, I would like to work with you, Mr. Chairman, and others on 
this Committee and try to get these changes and maybe put them 
in the Fair Credit Reporting Act. I really thank you for having a 
hearing on a very much needed topic. 

Chairman Shelby. Thank you. Senator Schumer. 

It is obvious, I think, here today that there is great interest on 
the Republican and Democratic side to do something about this 
issue, do something for the consumer, and I believe we can do it 
working together. 

Senator Bunning. 

STATEMENT OF SENATOR JIM BUNNING 

Senator Bunning. Thank you, Mr. Chairman, and I want to 
thank all our witnesses who are about to testify. It is a very impor- 
tant hearing and a very important issue. 

The technology boom has made most Americans live easier. With 
the Internet, we can get information that a few years ago it would 
have taken hours to research in just a matter of seconds. Workers 
are more efficient. It provides multiple entertainment options, and 
people can shop from home. 
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Unfortunately, the technology boom has also provided many op- 
portunities for another class of Americans: criminals. We have all 
heard the horror stories of identity theft, all of us. We will hear 
much more about it today. It is a problem, and we have to deal 
with it. Many have had their lives destroyed, and it has taken 
years for them to recover. We must make it harder for the criminal 
to steal. We must make the punishment fit the crime. And we must 
help victims recover quicker. 

I think we can accomplish all of these goals. Fighting identity 
theft is not a partisan issue, and in the tradition of this Committee, 
I am sure we will tackle it in a bipartisan manner. 

I am also pleased to note that the Administration has been work- 
ing extensively on this problem. I look forward to working with 
them and all of the Members of this Committee so that we can get 
a good bill that we can all support and that will help solve this 
growing problem. 

I am very impressed with the diversity of opinion we have before 
us today. Once again, we have the FTC and others who are about 
to testify. We have the Secret Service to tell us how to recognize 
how identity theft works and how they investigate it. We have wit- 
nesses from the finance and retail industries to let us know what 
they are trying to do to prevent identity fraud. And we have con- 
sumer groups here to let us know how the average consumer is af- 
fected and what victims can do. 

This is a very important subject, and I applaud the Chairman for 
holding this hearing. Once again, thank you, Mr. Chairman, and 
all of our witnesses for testifying. 

Chairman Shelby. Thank you. Senator Bunning. 

Senator Sarbanes. 

STATEMENT OF SENATOR PAUL S. SARBANES 

Senator Sarbanes. Mr. Chairman, I want to commend you for 
holding this hearing. I think identity theft is a very serious na- 
tional problem. It is an issue of great concern, obviously, on both 
sides of the aisle. Here in the Senate, a number of Senators actu- 
ally have already in one way or another indicated their interest in 
seeking legislative improvements in this area. Senator Bennett ac- 
tually held a hearing 5 or 6 years ago on the subject of financial 
instrument fraud. I know that Senators Bunning, Crapo, Kyi, Cant- 
well, Daschle, Corzine, Leahy, Feinstein and many, many others 
have offered and supported legislation. I could go on and on. So 
there is obviously very keen interest in it. 

It is obvious why. Identity theft has become an increasingly 
growing problem in recent years. Business Week recently stated in 
an article entitled “To Catch an Identity Thief,” “Identity theft is 
one of the fastest-growing crimes in the tJnited States” The Federal 
Trade Commission reported that in 2002, they received over 
380,000 consumer fraud complaints, of which about 162,000, or 43 
percent, were about identity theft. Identity theft complaints far ex- 
ceeded complaints about other types of consumer fraud at the FTC. 
The number of complaints about identity theft — and many of these 
are not reported incidentally, so this is only to some extent the tip 
of the iceberg — was 88 percent more in 2002 than in 2001. 
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Obviously, Americans have strong concerns about protecting 
their confidential information. This is an area, Mr. Chairman, in 
which you have shown a great deal of concern and leadership. Hon- 
est citizens who are victims of identity theft incur a high cost in 
money, time, anxiety, and efforts to correct and restore their 
spoiled credit histories and their good credit name. 

I look forward to hearing the testimony of the witnesses today 
about ongoing enforcement efforts and what additional measures 
can be taken to bring identity theft under control. 

I am very frank to tell you that I do think that, in the context 
of working on the Fair Credit Reporting Act, this is an opportunity 
to encompass within that initiative serious and effective measures 
to come to grips with this problem of identity theft. It is reaching 
epidemic proportions out there. It is devastating honest, hard- 
working, law-abiding people who become the victims of these, in 
many instances, very ingenious schemes, and in some instances 
brutally simple schemes. And, I think, as we address the FCRA 
issue, this is the right opportunity to address this identity theft 
question as well. 

Chairman Shelby. Thank you. Senator Sarbanes. 

Senator Bennett. 

STATEMENT OF SENATOR ROBERT F. BENNETT 

Senator Bennett. Thank you, Mr. Chairman, and as Senator 
Sarbanes has noted so graciously, we did hold a hearing on this 
subject back in the days when Senator D’Amato was the Chairman 
of the Committee and I had a Subcommittee focusing on financial 
services and high technology. I discovered that, at least at that 
time, it was not high technology that was the principal source of 
identity theft. People would steal mail, and upon stealing mail they 
would hope they would get lucky and get some piece of information 
that could then be useful to them. And, of course, the real bonanza 
would be if they could find a credit card in the mail. 

So, I will be very interested to hear what has happened in the 
time since then, and I agree with Senator Sarbanes that it is very 
appropriate that these hearings be held in the context of reviewing 
the Fair Credit Reporting Act. The Fair Credit Reporting Act has 
been attacked by some as being a challenge to the privacy of indi- 
viduals, and ironically, the system that has been created under the 
Fair Credit Reporting Act in the past also provides the greatest 
bulwark against identity theft, because if you have sound informa- 
tion in a number of different places, you have the building blocks 
with which you can rebuild your credit background and history. 
And without that information, without the flow that comes between 
the various credit reporting agencies, you have a much more dif- 
ficult time reclaiming your true identity. 

There was once a movie called “The Net” where the heroine of 
the movie had her entire identity stolen, and there was no place 
she could go to prove who she was because, given the magic of Hol- 
lywood, they were even able to ascribe her fingerprints to somebody 
else. Being Hollywood, of course, they figured it out before the last 
reel, and she emerged triumphant. But if there were someplace 
where she could go to say this is the sound information about me 
that has been accumulated that I can tap into, it would have killed 
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the premise for the movie in the beginning, which is probably why 
nobody went to it. But it is something we should consider as we 
are addressing the Fair Credit Reporting Act. 

I am very strongly in favor of reauthorizing the Fair Credit Re- 
porting Act so that we do not get an interruption in the progress 
that we have made in the years that it has been established. But 
I think a hearing like today’s, where we are brought up to date on 
the extent of identity theft, the technological challenge of fighting 
it, and the various progress that has been made is a very salutary 
thing to do. 

Chairman Shelby. Thank you. Senator Bennett. 

Senator Miller. 

COMMENTS OF SENATOR ZELL MILLER 

Senator Miller. Thank you for holding this hearing. It is very 
timely, Mr. Chairman, and I thank our witnesses for being here, 
and I have no opening statement. 

Chairman Shelby. Thank you. 

On our first panel today we have Mr. Howard Beales, Director 
of the Consumer Protection Bureau, Federal Trade Commission; 
and Mr. Timothy Caddigan, Special Agent in Charge, Criminal In- 
vestigative Division, U.S. Secret Service. 

Gentlemen, we welcome you both here. Your written statements 
will be made part of the record in their entirety. Mr. Beales, we 
will call on your first. Proceed as you wish. 

STATEMENT OF J. HOWARD BEALES, III 
DIRECTOR, BUREAU OF CONSUMER PROTECTION 
U.S. FEDERAL TRADE COMMISSION 

Mr. Beales. Thank you, Mr. Chairman and Members of the 
Committee. My name is Howard Beales, and I am the Director of 
the Bureau of Consumer Protection at the Federal Trade Commis- 
sion. I am pleased to have this opportunity to discuss identity theft 
and its relationship to the Fair Credit Reporting Act. The views ex- 
pressed in the written statement represent the views of the Com- 
mission, but my oral presentation and responses to questions are 
my own and do not necessarily reflect the views of the Commission 
or any individual Commissioner. 

Identity theft can be devastating to consumers’ reputations, to 
their financial well-being, and to their sense of security. At the 
FTC, we are fighting identity theft on many fronts. We are training 
local law enforces on how they can fight identity theft, and we are 
providing local law enforcers with case referrals from our Identity 
Theft Data Clearinghouse. We are also working to keep consumers’ 
financial data safe through our new safeguards rule, which took 
effect at the end of May, and our enforcement actions against com- 
panies that fail to keep their security promises to consumers. 

Just yesterday, we announced a settlement with online retailer 
Guess.com for failing to protect consumer data as promised. We 
also released a tip sheet for businesses on steps they should take 
to assure the security of their online systems. 

Through workshops, educational campaigns, and our identity 
theft hotline, we are counseling consumers and businesses on how 
to prevent identity theft. We are also providing consumers with 
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tools such as the uniform identity fraud affidavit to help them re- 
cover more quickly and easily from identity theft when it occurs. 

Today, you have asked for testimony about identity theft and 
the Fair Credit Reporting Act. In addition to harming consumers, 
identity theft also threatens the fair and efficient functioning of 
consumer credit markets. It undermines the accuracy and the 
credibility of the information flows that support those markets. 

Credit bureaus are simultaneously a target for identity thieves 
and a valuable resource for combatting identity theft. The credit re- 
porting system can play an important role in helping to detect 
identity theft, in limiting the damage from identity theft when it 
occurs, and in helping identity theft victims clean up the mess that 
the thieves leave behind. 

The Fair Credit Reporting Act helps consumers detect identity 
theft by providing consumers access to credit reports when they 
need them most. A credit report digests in one timely document all 
accounts opened in a consumer’s name, and it is the best way to 
discover those accounts that may have been opened by an impostor. 

Under the FCRA, a consumer who believes that he may have 
fraudulent information in his or her file is entitled to a free credit 
report. Moreover, the Fair Credit Reporting Act requires that a 
consumer who is denied credit based on his credit report be notified 
of the adverse action and given the opportunity for a free copy of 
his credit report. This adverse action notice can alert consumers 
that they may have bad marks on their credit record that they do 
not know about, and the free credit report helps them to pinpoint 
the fraudulent accounts. Adverse action notices provide consumers 
with a critical safeguard, and we are vigorously enforcing the stat- 
ute’s adverse action provisions. 

In addition to helping victims detect identity theft, the credit 
reporting system helps limit the damage that identity thieves can 
cause. It allows for the placement of a security alert in a victim’s 
credit file. Currently, the three major credit bureaus include a 
standardized format security alert in the credit reports of identity 
theft victims. This alert puts potential creditors on notice that they 
should proceed with caution when granting credit in the victim’s 
name. 

Finally, the credit reporting system can help identity theft vic- 
tims clean up the bad marks caused by an identity thief. A common 
problem of victims is that they find it difficult to get credit, insur- 
ance, or employment in the wake of an identity theft incident be- 
cause the impostor has damaged their credit history. The Big Three 
credit bureaus now allow victims to block fraudulent information 
on their credit report with a valid police report of the identity theft 
incident. 

We are also working with the three credit bureaus to develop 
other victim assistance programs. For example, this spring, the Big 
Three credit bureaus implemented their joint fraud alert initiative 
whereby victims need only make a call to one credit bureau to get 
a security alert and a free credit report from all three. There is al- 
ways more we can do, and we are always looking for new opportu- 
nities and new ways that we can make recovery easier for victims 
when this crime occurs. 
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I thank you very much for the opportunity to appear today, and 
I will he happy to respond to your questions. 

Chairman Shelby. Thank you, Mr. Beales. 

Mr. Caddigan. 

STATEMENT OF TIMOTHY CADDIGAN 
SPECIAL AGENT IN CHARGE 
CRIMINAL INVESTIGATIVE DIVISION 
U.S. SECRET SERVICE 

Mr. Caddigan. Thank you, Mr. Chairman and Senator Sarbanes. 
Thank you for inviting me to be part of this hearing today, and the 
opportunity to address the Committee regarding the Secret Serv- 
ice’s efforts to combat identity crime and protect our Nation’s finan- 
cial infrastructure. 

For over two decades, the Secret Service has been the leading 
Federal law enforcement agency for the investigation of access de- 
vice fraud, including credit and debit card fraud. We also continue 
to share jurisdiction with other law enforcement agencies in iden- 
tity crime cases. The explosive growth of these crimes has resulted 
in the evolution of the Secret Service into an agency that is recog- 
nized worldwide for its expertise in the investigation of all types 
of financial crimes. Our efforts to detect, investigate, and prevent 
financial crimes are aggressive, innovative, and comprehensive. 

The burgeoning use of the Internet and advanced technology, 
coupled with increased investment and expansion, has intensified 
competition within the financial sector. Although this provides ben- 
efit to the consumer through readily available credit and consumer- 
oriented financial services, it also creates a target-rich environment 
for today’s sophisticated criminals, many of whom are organized 
and operate across international borders. 

Simply stated, identity crime is the theft or misuse of an individ- 
ual’s personal or financial identifiers in order to gain something of 
value or to facilitate other criminal activity. Types of identity crime 
include identity theft, credit card fraud, bank fraud, check fraud, 
false identification fraud, and passport/visa fraud. Identity crimes 
are almost always associated with other crimes such as narcotics 
and weapons trafficking, organized crime activity, mail theft and 
fraud, money laundering, immigration fraud, and terrorism. 

Identity crime is not targeted at any particular demographic; in- 
stead, it affects all types of Americans, regardless of age, gender, 
nationality, or race. Victims include everyone from restaurant 
workers, telephone repair technicians, and even police officers, to 
corporate and Government executives, celebrities, and high-ranking 
military officers. 

What victims do have in common is the difficult, time-consuming, 
and potentially expensive task of repairing the damage that has 
been done to their credit, their savings, and their reputation. Ac- 
cording to the General Accounting Office, GAO, the average victim 
spends over 175 hours attempting to repair the damage inflicted by 
identity criminals. 

Identity crimes originate when another person obtains your per- 
sonal or financial identifiers. The methods of acquiring such infor- 
mation can range from so-called “dumpster diving,” where the 
criminal searches through your garbage for billing statements or 
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other documents that may include personal identifiers, to insiders 
who purge information from their own company’s database and 
place it for sale on the Internet. 

The events of September 11 have altered the priorities and ac- 
tions of law enforcement throughout the world, including the Secret 
Service. As part of the new Department of Homeland Security, the 
Secret Service will continue to be involved in collaborative efforts 
to analyze the potential for identity crime to be used in conjunction 
with terrorist activities through our liaison efforts with the Bureau 
of Immigration and Customs Enforcement, Operation Direct Action, 
FinCEN, the Diplomatic Security Service, and the Terrorist Fi- 
nancing Operations Section of the FBI. 

Since our inception in 1865, the twin pillars of the Secret Service 
have been prevention and partnership building. We simply could 
not fulfill our dual mission of protecting our Nation’s elected lead- 
ers and safeguarding our financial infrastructure without two es- 
sential elements: Incorporating preventive strategies and training, 
and building cooperative, trusted relationships with our local. 
State, and Federal law enforcement partners. 

A central component of the Secret Service’s preventive and inves- 
tigative efforts has been to increase the awareness of issues related 
to financial crimes investigations in general, and of identity crimes 
specifically, both in the law enforcement community and the gen- 
eral public. The Secret Service has worked to educate consumers 
and provide training and resources to law enforcement personnel 
through a variety of partnerships and initiatives. 

The Secret Service has already undertaken a number of unique 
initiatives aimed at increasing awareness and providing the train- 
ing necessary to combat identity crime and to assist victims in rec- 
tifying damage done to their credit. This includes the development 
of a number of training tools designed to assist our local law en- 
forcement partners. 

Mr. Chairman, I cannot emphasize enough the importance of 
sharing our expertise with our local and State police partners and 
empowering them with the ability to respond on the local level to 
identity crimes. In a Nation of thousands and thousands of commu- 
nities and a population exceeding 280 million, providing the first 
responder — in this case, the local police officer — with the tools and 
resources they need to investigate an identity crime and provide 
victim assistance is imperative. 

So, in partnership with the International Association of Chiefs of 
Police, the Secret Service produces the “Best Practices Guide to 
Searching and Seizing Electronic Evidence.” The pocket-size guide 
instructs law enforcement officers in the seizure of evidence from 
personal computers, wireless telephones, to digital cameras. 

We have also worked with this group and our private sector part- 
ners to produce the interactive, computer-based program known as 
“Forward Edge,” which takes the next step in training officers to 
conduct electronic crimes investigations. The “Forward Edge” CD- 
ROM incorporates virtual reality features as it presents different 
investigative scenarios to the trainee as well as provide investiga- 
tive options and technical support to develop the case. Thus far, we 
have distributed, free of charge, over 300,000 “Best Practices 
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Guides” and over 20,000 “Forward Edge” CD’s to local and Federal 
law enforcement. 

In addition, we are nearing the completion of the Identity Crime 
Video and CD-ROM which will contain over 50 investigative and 
victim assistance resources that local and State law enforcement 
officers can use when combatting identity crime. This CD-ROM 
also contains a short identity crime video that can be shown to po- 
lice officers at their roll call meetings, which discusses why identity 
crime is important, what other departments are doing to combat 
identity crime, and what tools and resources are available to those 
officers. 

Next week, we will be sending an Identity Crime CD-ROM to 
every law enforcement agency in the United States. Departments 
can make as many copies as they wish and distribute the resources 
to their officers to use in investigations. Over 25,000 CD-ROM’s 
are being prepared for distribution. 

In short, any police department in the country, regardless of size 
or resources, now has access to state-of-the-art training as well as 
multiple investigative and victim assistance resources to help them 
combat identity crime. 

As part of a joint effort with the Department of Justice, the U.S. 
Postal Inspection Service, and the Federal Trade Commission, as 
well as the International Association of Chiefs of Police, we have 
been hosting Identity Crime Training Seminars for law enforce- 
ment officers. In the last year and a half, we have held such train- 
ing seminars in Chicago, Dallas, Las Vegas, Des Moines, Iowa, and 
Washington, DC. In the coming months, we have training seminars 
scheduled in New York, the State of Washington, and Texas. These 
training seminars are focused on providing local and State law en- 
forcement officers with the tools and resources that they can imme- 
diately put into use in their investigations of identity crime. 

For law enforcement to properly prevent and combat identity 
crime, steps must be taken to ensure that local. State, and Federal 
agencies are addressing victim concerns in addition to actively in- 
vestigating identity crime. All levels of law enforcement should 
have access to the resources used to combat identity crime and to 
assist victims in rectifying the damage inflicted. It is essential that 
law enforcement recognize that identity crimes must be combatted 
on all fronts, from the officer who receives a victim’s complaint, to 
the detective or the Special Agent investigating an organized iden- 
tity crime ring. 

The U.S. Secret Service is prepared to assist this Committee in 
protecting and assisting the people of the United States, with re- 
spect to the prevention, identification, and prosecution of identity 
criminals. 

Mr. Chairman, that concludes my prepared remarks, and I will 
be happy to answer any questions that you or the Members of the 
Committee may have. 

Chairman Shelby. Thank you very much. 

Mr. Beales, one of the outstanding issues in this debate is deter- 
mining the actual scope of the identity theft problem. In a report 
issued last year, the GAO indicated that, “It is difficult to fully or 
accurately quantify the prevalence of identity theft. Nevertheless, 
the prevalence and cost of identity theft seems to be increasing. 



86 


according to the data we reviewed and the many officials of the 
public and private sector entities we contacted.” Do you agree with 
that sentiment? Is that an understatement? 

Mr. Beales. I think there is no question it is a serious problem. 
I think there is also no question that we do not have a good fix 
right now on exactly how big a problem it is. 

We have been conducting a survey in a random sample of people 
to try to find out how many victims there really are. We are in the 
process of analyzing that data now and expect to be able to release 
it at some point next month. And then we should have, I think for 
the first time, a good, solid estimate of what really is the incidence 
of identity theft. 

Chairman Shelby. Are you working, in that regard, with the 
FBI, the Secret Service, and local people to get all that informa- 
tion? 

Mr. Beales. On the survey, no. This was a consumer survey to 
figure out how many people have been victims. It is akin to the vic- 
tim surveys that are sometimes done in other criminal areas. And 
that is what we are doing here. 

Chairman Shelby. What is the total number of staffers that you 
have involved at the Federal Trade Commission in this effort? And 
if identity theft is getting worse, as we all seem to believe, are you 
dedicating more and more staff resources to this area? Or are you 
standing pat or what? 

Mr. Beales. We have a somewhat unusual role in identity theft 
because we do not have a direct enforcement role because it is a 
criminal problem and we are not a criminal agency. 

Where we have substantially increased resources is in handling 
the calls. As the call volume has grown, then the resources that we 
have to devote to it have grown correspondingly. And we have real- 
ly made a significant increase in the resources that we have de- 
voted to security enforcement to try to protect data that businesses 
keep that could become the source of identity theft. So it is a law 
enforcement effort that is really focused on preventing access to the 
kinds of data that identity thieves need. 

Chairman Shelby. That is your role at the FTC? 

Mr. Beales. Yes, sir. 

Chairman Shelby. Mr. Caddigan, or Special Agent Caddigan, ex- 
cuse me, what is your view as to the level of sophistication of iden- 
tity thieves and identity theft practices? In other words, is there 
any indication that the thieves are becoming more organized? I 
know a lot of them are very sophisticated. 

Mr. Caddigan. Yes, sir, they have. I think a simple analogy 
would be: I do not need to go to the business to rob it anymore, 
I do not need to be in the same town, I do not need to be in the 
same State, and, quite frankly, I do not need to be in the same 
country. 

So when you look at it, that the access to the information that 
makes up the predicate offenses of identity crime can be obtained 
globally, they move globally 

Chairman Shelby. They can rob without a gun. 

Mr. Caddigan. That is correct, sir. And the anonymity that the 
access to the Internet provides makes the enforcement effort that 
much more difficult. 
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We do see an increase in organized groups, for example, gang- 
related. We do see typical street crimes that would have been com- 
mitted by groups that are now using a computer or the Internet or 
access to the Internet to get the same kind of profit return. 

Chairman Shelby. Are the identity thieves generally sophisti- 
cated enough to determine weaknesses in the system, in other 
words, do the thieves evolve? 

Mr. Caddigan. They do evolve, sir. We find that the organized 
hacking groups that hack systems, whether it be business, public, 
or private, they hack for the thrill of the hacking. It is a personal 
challenge. But the rewards are the database files that they can get 
out of a business or an enterprise that are readily sellable on the 
Internet market. 

Chairman Shelby. Kind of high value to the thieves. 

Mr. Caddigan. Yes, sir. 

Chairman Shelby. Help us understand what an identity thief 
could do, for example, if he or she obtained, a name, a Social Secu- 
rity number, and a mother’s maiden name; the full contents of a 
credit report. I know you can speak to all of it. 

Mr. Caddigan. With that information, you can pretty much 
have — well, assuming a good name that you have collected 

Chairman Shelby. You can ruin somebody, can’t you? 

Mr. Caddigan. You can definitely ruin somebody, and there are 
many case examples of where that has occurred. 

Chairman Shelby. How do thieves routinely go about obtaining 
these pieces of information? I know that they do not all go to the 
dumpster. 

Mr. Caddigan. They all do not. That would be, obviously, the 
low-tech aspect. 

Chairman Shelby. But some do. 

Mr. Caddigan. The low-tech aspect are just thieves, and thieves 
steal mail and information and anything they can get their hands 
on. The higher-tech, then we get into the hacking groups that work 
internationally, and there is a trade in the product. The end user 
typically would buy — it is very simple to buy that information over 
the Internet. 

Chairman Shelby. Are the older people in America, people like 
me, 39 and older, are they generally a lot of the victims? 

Mr. Caddigan. You know, I do not know that we find that to be 
the case. I think the demographics 

Chairman Shelby. Cuts across everything? 

Mr. Caddigan. Cuts across the whole spectrum. 

Chairman Shelby. With what you know about criminal activity, 
do you have any ideas that you can share today about the steps 
that all of us as consumers can take to protect ourselves? And, also, 
how can the industry protect itself? Because, you know, we are 
interested in both. 

Mr. Caddigan. There is a tremendous need to identify you as a 
consumer to a business, and that is readily recognized. So that in- 
formation is necessary to affect trade. 

Where you can safeguard yourself is simple things at home. If 
you receive the preapproved credit applications in the mail, do not 
just throw them in the trash. Shred them. Your bank statements, 
shred them. That sounds a little drastic, but, again, the dumpster 
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diving does occur. It not only occurs at your curb; but also it occurs 
at the facilities that trash companies use and the dumps that they 
go to. So the more you can safeguard the information at your level, 
the better. 

The other thing, he very wary of anyone that might call or reach 
out to you, Internet, telephone, e-mail, or otherwise, asking for 
your identifiers. If you have not solicited that information or that 
service, you should not he giving anyone anything. 

Also, be very wary of companies that use spam. We have many 
examples on the Internet to where an Internet provider has been 
victimized because someone has accessed their system, provided a 
questionnaire under the head of that Internet provider, and people 
readily give it thinking it is valid. 

So there are a lot of good anecdotal data that the less you give 
out, the better protected you are. 

Chairman Shelby. Thank you. 

Senator Corzine. 

Senator Corzine. Thank you, Mr. Chairman. 

I think the scope of questions that you raised are highly valuable 
so that we understand the nature of the problem. But when we are 
speaking about understanding it, one of the disciplines of financial 
markets is the information that people have about their own infor- 
mation that is involved in the system. That gets at a question that 
I think was asked to Mr. Beales in the House Financial Services 
Subcommittee. Do financial institutions have any requirement to 
notify a consumer if there is a security breach? Is that a weakness 
or a strength of our system? 

Mr. Beales. There is not at the present time, as far as I know, 
a requirement to notify consumers if the information has been 
breached. We think in many circumstances that notice to con- 
sumers clearly makes sense. 

There may be some circumstances where you are fairly sure 
about how the information was lost, where there is not much of a 
risk and not much benefit to notifying the consumer. But we think 
in most cases certainly the best practice is to notify consumers 
when the information has been compromised in a way that puts 
them at risk. 

Senator Corzine. It is hard for me to imagine circumstances 
where personal information is breached without authorization that 
it would be a positive. Maybe it is a neutral, but I certainly can 
imagine situations where breaching poses a risk and certainly lim- 
its the individual’s ability to clean up their credit history. 

Is there a voluntary program on the part of the credit reporting 
agencies or credit-monitoring agencies, the Big Three, or any of the 
financial institutions? Has there been a survey taken about how 
much notification of consumers is actually taking place with regard 
to breaches? 

Mr. Beales. We know of notification in a number of incidents. 
We do not know systematically as to how frequently that happens 
or what fraction of all incidents it occurs. It clearly happens in 
many cases, but we do not know what fraction. 

Senator Corzine. And do you have any sense of the proportion 
or the awareness or how quickly even in those instances where 
institutions do notify, how quickly individuals know that so that 
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damage is not done? This is, by the way, costly both to the industry 
and to the individual, I presume, if someone has stolen an identity. 
Is there any sense or timing with respect to how people become 
aware? Since there is no requirement, I guess there is no deadline 
on that process. 

Mr. Beales. No, and there is no systematic monitoring of how 
long it takes. I think the big question is how long does it take to 
discover the breach. In many cases, that is maybe the main deter- 
minant of how much consumers are at risk is how much time went 
by before the breach was discovered at all. 

I think one thing that is really important in those circumstances 
is for the financial institution or whoever it was that was the 
source of the information to make contact with the credit bureau, 
because that is in many ways the promptest way to get the infor- 
mation into the right places, to give it directly to the credit bureau 
that these accounts may have been compromised. 

Senator Corzine. So the primacy of the credit bureau to the indi- 
vidual? 

Mr. Beales. What the individual has to do in order to reduce the 
risk is to call the credit bureau, and by making contact with the 
credit bureau in the first place. A, the credit bureau knows that 
they are going to get a lot of calls and what is going on and can 
be ready to handle that volume without being disrupted; and, B, 
in some circumstances, the fraud alert can be placed quicker and 
the risk reduced quicker rather than waiting for a letter to go to 
the consumer and the consumer to respond to the letter and place 
the fraud alert. 

Senator Corzine. They could do that simultaneously, I presume, 
both the individual and the credit bureau. 

Mr. Beales. Sure. There is no reason for contacting a credit bu- 
reau to delay a notice to the individual, but it is an important part 
of the process. 

Senator Corzine. Access to credit reports — and I apologize for 
running over here — conceptually, do you believe that this is an im- 
portant element in being able to have an individual maintain cer- 
tainty about their credit status and ability to manage their credit 
profile in this complex but important and well-functioning system 
in many ways? 

Mr. Beales. I think it is a critical part of the system, and the 
way the system functions now with notice when there is an adverse 
decision based on a credit report or when there is fraud, in either 
of those circumstances the consumer is entitled to a free credit re- 
port that will let them identify the problems and start the process 
of correcting them. And I think that is a crucial component for 
maintaining the accuracy of the data that is in credit reports. 

Senator Corzine. Thank you. 

Chairman Shelby. Senator Dole. 

Senator Dole. Mr. Beales, I would like to ask you about the affil- 
iate-sharing preemption in the Act. In efforts to prevent identity 
theft and to detect it, is this preemption helpful or does it harm 
efforts? 

Mr. Beales. I think information sharing is really a key in the 
fight against identity theft. I think it is important for the creditor 
to know more about the real you than the thief knows, and that 
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way the creditor can ask you a question that only the real you can 
answer and the thief cannot answer. 

Some of that information comes from affiliates, and some of it 
may come from databases from outsiders, and some of it may come 
from credit reporting agencies. 

All of those sources are important to the overall sharing of infor- 
mation that makes it possible to detect that the identity thief is, 
in fact, a thief. 

Senator Dole. Let me just ask you the same question about the 
prescreening preemption. 

Mr. Caddigan. I think information 

Senator Dole. How do you see — go ahead. 

Mr. Caddigan. I would concur with Mr. Beales. Anytime there 
is information sharing that you can more quickly identify fraud or 
the potential for fraud, the easier it is to eliminate the problem as 
an individual. And I think as a total problem, the education and 
information sharing is critical from the enforcement perspective. 

Senator Dole. What about the prescreening preemption? 

Mr. Beales. We do not think that, based on the data we have 
seen, there are clearly instances where prescreening may lead to 
identity theft in that particular case. In the data we have seen, 
though, the overall losses to identity theft seem to be lower on 
prescreened accounts than they are on just general applications for 
credit. So, we do not think that prescreening in any systematic way 
contributes to identity theft or contributes to the problem. 

Senator Dole. And with regard to the widely reported cases of 
credit reports being stolen, I would like to ask both of you: Do you 
think the problem is primarily due to a lack of security in the sys- 
tem? Or is it just a cost of doing business, a fact of business in this 
technological age? Which would you say is primarily responsible? 

Mr. Caddigan. I think on the user end of the consumer informa- 
tion. If you talk about the credit bureaus, speaking again from the 
enforcement perspective, we have very sound relationships with 
them, and we have worked extensively over the years. They take 
great measures in safeguarding their information. So when a per- 
son is violated, it is usually at the user end, and that is part of 
the education process that I think not only law enforcement does, 
but also I know the FTC does with businesses, is to teach them 
better safeguards with regard to their IT systems that control ac- 
cess to these credit reports. 

There are many examples of someone who legitimately has 
access to report files who, for whatever reason, left his computer 
on when he walked away or granted access to others not knowing 
that they then could have access. So there are safeguards that are 
evolving, but we still find instances where they are not safe- 
guarded. 

Senator Dole. Mr. Beales. 

Mr. Beales. Our safeguards rule that went into effect at the end 
of May really views security as a process. It asks companies to 
identify the risks they face and then look for the steps that they 
can take to reduce those particular risks. 

I think one thing that is clear about security, though, is that the 
threats evolve, and that as you put in place a mechanism to deal 
with the last problem, identity thieves and other thieves will try 
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to find ways around that. So businesses need to be constantly alert 
to adjust the precautions that they take in order to deal with new 
and emerging threats and adjust their plans accordingly. 

When we see a breach, and particularly if it is a credit bureau, 
it is something we are very interested in as to whether there may 
have been a law violation in that particular case or a violation of 
our rule. We work with other law enforcement authorities and de- 
termine, you know, who can best take appropriate action in any 
particular case. 

Senator Dole. Agent Caddigan, could you just give us an idea of 
the percentage of identity theft cases that are perpetrated from 
outside the country over the Internet? 

Mr. Caddigan. I don’t know that I can give an accurate percent- 
age. I can say that we see more and more case examples of where 
we have traced the origin of the crime to overseas sources, all four 
corners. I cannot pick a country or a sector. But we do see a tre- 
mendous rise in Internet hacking activity that leads us overseas. 

Senator Dole. Thank you. I believe that my time has expired, 
Mr. Chairman. 

Chairman Shelby. Senator Sarbanes. 

Senator Sarbanes. Gentlemen, we are pleased to have you here. 
I really want to get beyond where we are, telling about the problem 
and how it is expanding and all that, and find out what we can do 
about it. It seems to me the burden is on the two of you and your 
respective agencies to give us a list of things. I am going to ask you 
for that in a moment, but I want to run through some questions 
with you first. 

Do you think a consumer getting their credit report is helpful in 
checking identity theft? Is that a helpful, preventive technique? 

Mr. Caddigan. Yes, sir, I do. 

Senator Sarbanes. Some States now require that the consumer 
get a free report, right? 

Mr. Cardigan. Yes, sir. 

Senator Sarbanes. What would be the problem if the Federal 
law required everyone would be able to get a free report if they re- 
quested it? 

Mr. Cardigan. From an enforcement perspective, I do not see a 
problem. 

Senator Sarbanes. Wouldn’t that be a pretty common-sense 
thing to do? 

Mr. Caddigan. Correct. 

Senator Sarbanes. Now it puts a little extra burden on the agen- 
cies, but it seems to me if we are going to be serious about doing 
something like this, that is a common-sense thing to do. Georgia 
actually, I think, is the one State that requires that you can get 
two free reports in a year. In a number of other States, including 
my own, you can get one every year. But we have left it to the 
States to do it. They want preemption from State law on the Fed- 
eral credit reporting which we are now considering. We need some 
standards if we are going to preempt from the Federal level. It 
seems to me an obvious standard, just as a starter, would be a free 
credit report. Do you disagree with that? 

Mr. Caddigan. I do not, no, sir. 

Senator Sarbanes. Mr. Beales. 
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Mr. Beales. The Commission has not taken a position on free 
credit reports. 

Senator Sarbanes. Why not? 

Mr. Beales. The staff is continuing to analyze that and a variety 
of other suggestions that 

Senator Sarbanes. We are going to push the staff hard to get 
some suggestions up here. 

Now, let me ask another question 

Chairman Shelby. Senator Sarbanes, our staff will not need to 
be pushed. 

Senator Sarbanes. No, not our staff. Their staff. 

Chairman Shelby. That is what I meant. 

[Laughter.] 

Our staff will be helping us with the legislation. 

Senator Sarbanes. All right. Now some have suggested that the 
practice of mailing out preapproved credit card solicitations may in- 
crease the incidence of identity theft, and also sending out these 
unsolicited credit card convenience checks. Does that increase the 
risk of identity theft? 

Mr. Caddigan. I think over the years we have seen a change in 
those type of mailings, where it used to be basically an application 
was sent to you completed, you signed it and sent it back. So the 
mail theft or the dumpster diving or that type of activity made vul- 
nerable to identity theft. 

The later documents that we see, name and address, and the 
focal point would be if you signed it and sent it back and changed 
your address, that is an automatic decline. The product itself, if 
handled appropriately at both ends, does not lead to potential iden- 
tity crime. I think the misuse of it or the mishandling of it has po- 
tential for identity crime. 

Senator Sarbanes. We are going to have to look at that because 
we are sympathetic to expanding commerce and so forth and so on, 
but it may be at some point this expansion opens up vulner- 
abilities. And then you have to trade off the question between cur- 
tailing the vulnerabilities and perhaps losing some expansion of 
commerce. 

Now, I know that is going to raise a problem to those who send 
out these preapproved credit card solicitations or these unsolicited 
credit card convenience checks. But we need to look at that and see 
how much it is contributing to the problem, whether this is some- 
thing that can be checked. 

There is a notion here that any technique can be used to kind 
of draw the consumer in, and then if they become a victim of iden- 
tity theft, it is kind of, well, it is too bad for the consumer and 
maybe some way we will catch up with it or somehow or other and 
things will get corrected. But we may need to take steps up front 
to reduce the exposure to the identity theft happening. 

Now let me ask you this question. A May 2003 survey conducted 
by the Harris Interactive Service Bureau of employees and man- 
agers with access to sensitive customer information — this raises a 
problem that I think is very difficult to deal with — shows that 66 
percent say their coworkers, not hackers, pose the greatest risk to 
consumer privacy. The Washington Post had an article, “Identity 
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Theft More Often an Inside Job,” and they are raising the question 
that it comes from insiders. What is your view of that? 

Mr. Caddigan. I would agree wholeheartedly. The insider is the 
greatest threat to business today. One of the things that the Secret 
Service has undertaken over the last year, year and a half, is an 
insider threat study. We have gone to businesses, we have gone to 
financial institutions, we have gone to victims of that type activity 
in order to determine whether we can develop indicators to try to 
prevent that. 

At the same time, we are working with those private sector en- 
terprises and helping them design safeguards to their system that 
can better secure against the insider threat. So, I would agree 
wholeheartedly that that is a major problem in business today, the 
safeguard of that personal information from business to business, 
and there are no standards. 

Senator Sarbanes. Do you have proposals or suggestions that 
you make to businesses of measures they could take to guard 
against this. Is that right? 

Mr. Caddigan. That is correct. 

Senator Sarbanes. And you seek their cooperation to do that on 
a voluntary basis. 

Mr. Caddigan. That is correct. 

Senator Sarbanes. Is that right? 

Mr. Caddigan. Yes, sir. 

Senator Sarbanes. If the measures have been carefully vetted 
and thought through, and if it is the judgment of law enforcement 
and other objective people that these measures would be effective, 
should not thought be given to requiring that these measures be 
taken? 

Mr. Beales. Senator, if the business is a financial institution, 
under Gramm-Leach-Bliley there is a requirement that they take 
security steps, either under FTC rules or under the corre- 
sponding — 

Senator Sarbanes. Do you have rules that would implement 
what Mr. Caddigan just told me he is trying to get them to do vol- 
untarily on this issue? 

Mr. Beales. Our rule requires a process rather than specific ap- 
proaches. The rule requires businesses to identify the risks they 
face and take appropriate steps to reduce those risks. The risks are 
different for different companies and in different circumstances. 

Senator Sarbanes. We have to get at this problem. 

Mr. Beales. I agree completely. 

Senator Sarbanes. We have to get at this problem. We cannot 
continue to pussyfoot around with it. And there is an opportunity 
here, as we shape this legislation, I think at least, to do something 
about this identity theft — this is ruining the lives of a fair number 
of people across the country. And it is a matter of growing concern 
in the public’s mind. 

You are on the battlefront. We need to hear from you. Let’s go 
beyond the great divide and hear from you about things that you 
think should be done, requirements that we can put into the law. 
Otherwise, one of the pressures that will come up from the State 
level and the consumers not to extend this legislation and the pre- 
emption will be the argument that this issue is not being 
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addressed, and if you would just let us get at it, we will take meas- 
ures to deal with this. 

Now if you want the national system — and there are economic 
arguments for it that I recognize, then you have to give some 
thought to some national standards that bring this problem under 
control. And we need from you a list of possibilities. Maybe it is in 
your dream world, you never thought it would be possible. All of 
a sudden here you are, you have some Senators asking you to give 
us the list. 

So, Mr. Chairman, I hope they will go away from here today and 
come back to us with some detailed suggestions in this regard. 

Chairman Shelby. Senator Sarbanes, I think you are absolutely 
right. But I think rather than possible, I think it is probable. 

Senator Sarbanes. Yes. 

Chairman Shelby. Senator Miller, I am going to recognize you. 
We would be interested in what Georgia does. 

Senator Miller. Senator Sarbanes has already stated it, and we 
have had that for some time. 

I think I am asking the same question Senator Sarbanes was 
getting at, but I would phrase it this way. This is to Mr. Beales. 
Do you think any new legislation is needed on identity theft, or can 
it be handled with the current rules and regulations? 

Mr. Beales. The one piece of legislation that the Commission 
has taken a position on is the penalty enhancements. I think that 
would be appropriate and useful in attacking this problem. 

We are looking, as I said, at a variety of possible proposals, and 
we will come back at some point with a list of possibilities that we 
think are good. But we are not ready to do that yet. 

Senator Miller. You are going to have to get in a hurry to get 
in front of this Committee. You realize that, don’t you? 

Mr. Beales. Yes, sir. 

[Laughter.] 

We actually left people behind to work on it, sir. 

Senator Miller. That is all I have. 

Chairman Shelby. Senator Sarbanes. 

Senator Sarbanes. I just want to make one comment about the 
penalty enhancement. The Commission has to get moving. The 
penalty enhancement is important but it is not enough, and I know 
there is — but I am reminded of John Coffee’s statement when we 
were working on the securities issues, he is a Professor of Securi- 
ties Law at Columbia University School of Law. And they asked 
him, “What about all these penalty enhancements that the Con- 
gress is doing?” He said, “Well, they are fine, but they need to do 
other things, preventive things in terms of the system that prevent 
it from happening in the first place.” The penalty enhancement, the 
damage has been done. You are just coming along trying to punish 
the person and create a deterrent, and there is a certain effect from 
that, obviously. I do not deny, although Coffee told the story, that 
in 18th Century London the penalty for pickpocketing was hanging. 
That was the penalty. And, of course, the hangings were public in 
the public square, and huge crowds would assemble to see the 
hanging. 

They caught this pickpocket, they tried him, they convicted him, 
and they sentenced him to hanging. So the day of the hanging. 
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thousands of people gathered to see the hanging of the pickpocket. 
And working the crowd of thousands of people were hundreds of 
pickpockets. 

Chairman Shelby. That is exactly right. 

[Laughter.] 

Senator Sarbanes. So, I want to prevent it from happening in 
the first place. 

Chairman Shelby. Senator Sarbanes, I think you are very much 
on track, you and, I believe, people on both sides of the aisle here. 

One or two of the main objects here in the renewal of this legisla- 
tion or to make it permanent, one is preemption, second is affiliate 
sharing. I agree with Senator Sarbanes. I think we would be dere- 
lict in our duty if we did not address the consumer problems in this 
bill, especially today, how to prevent and tighten up on identity 
theft. And I believe this Committee has already sent a message on 
both sides of the aisle that we are going to do this. 

Mr. Beales, you mentioned the benefit of adverse action notices 
in making consumers aware of problems with their credit reports 
and possibly detecting identity theft. In light of the movement of 
our credit system to an automated risk-based pricing system, do 
consumers, all of us, still receive adverse action notices when there 
is negative information on their credit report? Or do they simply 
receive a counter-offer at a higher price of credit? 

Mr. Beales. In many instances, in the credit area, they receive 
a counter-offer at a higher price. Under the law, if the consumer 
accepts that counter-offer, there is no adverse action because the 
FCRA definition is coupled to the definition under the Equal Credit 
Opportunity Act. If the consumer rejects that counter-offer, then 
there is adverse action and the adverse action notice goes. 

Chairman Shelby. Okay. Do adverse action notices still effec- 
tively serve this purpose if creditors do not reject credit applicants 
but simply offer them credit at a higher rate? In other words, how 
would a consumer know to look at their credit report without the 
adverse action notice? They would not know, would they? 

Mr. Beales. They would not know that that was the source of 
the information that it was based on. I think that is right. 

Chairman Shelby. That is a flaw here, is it not? 

Mr. Beales. It is a concern. 

Chairman Shelby. Wait a minute. It is a concern. It is some- 
thing that should be correct, isn’t it? 

Mr. Beales. Well, the difficulty — the balance of the adverse ac- 
tion notices 

Chairman Shelby. We will deal with the difficulties. Just say is 
it a concern, is it a concern, it is something that needs to be cor- 
rected? 

Mr. Beales. It is a problem, but like all problems, it has costs 
to fix it. And that is what the balance is. 

Chairman Shelby. We are not talking about that. We are talking 
about trying to prevent identity theft, trying to protect the con- 
sumer here. And you have been waffling here all morning. 

Mr. Beales. As I said, the Commission has not taken a position. 
I think that there is — adverse action notices have narrowed as we 
have moved to risk-based pricing. But, on the other hand, if you 
give notices too widely and in too many circumstances, then it no 
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longer — I mean, it becomes something that people ignore. The ad- 
verse action notice, as it was originally envisioned, fit well in the 
set of circumstances where consumers needed to pay attention to 
the credit report and did not raise a lot of false alarms. I think how 
to preserve that balance of doing both jobs is definitely an issue 
and one that we are looking at. 

Chairman Shelby. Senator Sarbanes, do you have anything? 

Senator Sarbanes. I think Senator Bennett 

Chairman Shelby. Senator Bennett, do you have any questions? 

Senator Sarbanes. I do not think he had a turn yet. 

Senator Bennett. Yes, my constituents come to see me, and im- 
portant as you are, the voters in Utah who need to get their pic- 
tures taken sometimes have a higher sense of urgency. 

As I deal with this issue over time, I have a reaction that I would 
like to share with you. First, let me say, going back to that first 
hearing that we held in my Subcommittee some years ago, I am 
very heartened at the progress that has been made. We were basi- 
cally in this room looking at each other throwing up our hands and 
saying, “What can we do?” And the hearing highlighted a whole 
series of problems and very, very few, if any, strategies with which 
to deal with the problem. So, I am heartened by the degree of in- 
volvement both of the Secret Service and the FTC. We have come 
a long way, and I think we should not lose sight of that fact. 

There seems to me to be a very interesting paradox here. The 
more information we can get in the hands of what I would call the 
good guys — that is, people who want the information for legitimate 
purposes, they want to improve their service to the customer, they 
want to be more efficient in offering products that the customer 
might use, and they use the information, therefore, for benign pur- 
poses — the better off we are. 

At the same time, the more information that we get in the hands 
of a wider number of people, by definition, the more vulnerable we 
are. And there is the paradox. We want affiliates sharing informa- 
tion, your response to Senator Dole. We want people at a wide 
range to have the information so they can check against each other 
when something seems to be going wrong. And at the same time, 
we do not want anybody to see this, for fear they might steal it. 

And that, I think, is the challenge that is facing the Congress, 
how to see to it that we take steps to prevent people from stealing 
information, but do it in a way that does not harm the beneficial 
effect of having this information in the hands of a fairly large num- 
ber of good guys, people who will use it for benign purposes rather 
than evil purposes. Is that a fair characterization of the challenge 
we face here? 

Mr. Beales. I think it is. I think that is exactly the nature of 
the problem. I believe the challenge is to try to control access in 
a way that keeps information from getting to the bad guys but 
makes as much information as possible available to the good guys. 
There are inherent risks that remain of the information being 
there, but if you hide the information, then you can pretend to be 
anybody. 

Senator Bennett. So paradoxically, if I am understanding ex- 
actly what you are saying, you could make identity theft easier if 
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you restricted too tightly the use of this information on the part of 
the good guys? 

Mr. Beales. Yes, sir, I think that is right. In fact, one claim that 
has heen made to me in my discussions of this issue is that one 
of the reasons for identity theft is that now you have to make up 
a real person because the information sharing system means you 
cannot just make up a name and an address b^ecause that will not 
work. The information sharing system will let us tell that there is 
no such person. So the name and address has to be a real some- 
body in order to apply for credit under a false identity. 

Senator Bennett. In an attempted to block identity theft, it 
seems to me the privacy advocates and the users of information are 
really on the same side. That is, the people who use the informa- 
tion to make marketing decisions and credit decisions do not want 
the information to leak because that will destroy their opportunity 
to serve a customer whom they hope will become a repeat cus- 
tomer. And the privacy advocates also do not want the information 
to leak. 

I make that point because I feel, at least in the press, which 
loves to create controversy, the standard of the schools of jour- 
nalism is you fight about it, we will write about it. And if you are 
not fighting, I have discovered since I got into politics, they will 
precipitate the fight and create antagonisms that they can write 
about even if those antagonisms do not exist. 

So in the press, there is an antagonism between the business 
community that says we need this information, and the privacy ad- 
vocates who say no it is bad if you get that information. In fact, 
the real alliance should be the business committee and the privacy 
people together saying it is good for there to be a widespread back- 
ground of information, as long as it is protected properly. Because 
if there is a leak, that reservoir of data becomes very helpful in re- 
constructing the real identity of the individual and fighting the evil 
effects of having that leak out there. 

Once again, is that a fair summary of what the real world is or 
am I reaching too hard for something? 

Mr. Beales. No, I think there should be some commonality on 
the identity theft issues of looking for sensible restrictions to pre- 
vent access by the wrong people. Identity theft is a problem that 
happens where information is used for ways that nobody ever con- 
templated, nobody ever intended, where in a great many instances 
the information is simply stolen and it is in everybody’s interest to 
try to control that problem. 

Senator Bennett. Thank you, Mr. Chairman. 

Chairman Shelby. Senator Sarbanes, any questions? 

Senator Sarbanes. I do not, but I want to follow up on what Sen- 
ator Bennett has said, the line he has just been pursuing, because 
I have some concern about it and I do it with reference to Mr. 
Caddigan’s statement. You say, “The burgeoning use of the Inter- 
net and advanced technology, coupled with increased investment 
and expansion, has intensified competition within the financial sec- 
tor. With lower costs of information-processing, legitimate compa- 
nies have found it profitable to specialize in data mining, data 
warehousing, and information brokerage. Information collection 
has become a common by-product of newly emerging e-commerce.” 
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Only you go on to say, “This has led to a new measure of growth 
within the direct marketing industry that promotes the buying and 
selling of personal information. In today’s market, consumers rou- 
tinely provide personal and financial identifiers to companies en- 
gaged in business on the Internet. They may not realize that the 
information they provide in credit card applications, loan applica- 
tions, or with merchants they patronize are valuable commodities 
in this new age of information trading. Consumers may be even 
less aware of the illegitimate uses to which this information can be 
put. This wealth of available personal information creates a target- 
rich environment for today’s sophisticated criminals, many of whom 
are organized and operate across international borders.” 

One of the questions, it seems to me, we have to face is whether 
this information gathering and warehousing and databanks that 
are created for marketing strategies are extending or enhancing 
the availability of information which opens it up even more to iden- 
tity theft. That is a purpose that is probably beyond the consumers 
horizon of why he or she is providing the information in the first- 
place, and goes beyond the purpose they sought to achieve. 

I am with Senator Bennett up to a point. In other words, you are 
providing this information. You need checks on it and so forth, and 
you provide it in order to let us say get a credit card. And then you 
use the credit card. The question is whether that information is 
taken and merchandised for other purposes and whether the mer- 
chandising of it for other purposes creates a vulnerability which 
can then be exploited for identity theft. Whereas if it had been 
more limited, although you need the exchange of information with- 
in the limitation, but if it had been more limited, you would not 
have had the same exposure. Do you see the question I am asking? 

Mr. Caddigan. Yes, sir, I do and I agree wholeheartedly. I think 
the information, when it is used in a check and balance situation, 
actually does prevent fraud. The institutions that work in this 
arena can site example and statistics to that effect. I think once 
that information is passed on again, every time it is resent or re- 
provided, you increase the risk of identity theft greatly. 

So from a law-enforcement perspective, I concur exactly. The di- 
viding line is the issue. Where should it be used and where is it 
marketed to where it becomes vulnerable, accessible to organized 
groups, and thus causes a problem. 

Senator Sarbanes. Thank you, Mr. Chairman. 

Chairman Shelby. Senator Dole, do you have other questions? 

Senator Dole. No. 

Senator Bennett. Mr. Chairman, can I follow up with just one 
quick question? 

Chairman Shelby. Yes, Senator Bennett. 

Senator Bennett. I will not prolong this. As I hear your answer, 
Mr. Caddigan, I just in my own mind, just to get it on the record, 
see a difference between selling the information to some outside 
group whose purposes you really do not understand or know any- 
thing about, and using the information within your own organiza- 
tion. We are back to Senator Dole’s question about an affiliate 
sharing. Would you agree that there is a difference between shar- 
ing that information within the umbrella of say a large financial 
services organization, from one affiliate to the other? That that 
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would be a lesser degree of vulnerability than say selling it to 
somebody whose business purposes you really do not understand? 

Mr. Caddigan. Yes, sir, I would agree with that. 

Chairman Shelby. Senator Sarbanes. 

Senator Sarbanes. Let me just continue here for a moment. It 
was noted here at one hearing that Citicorp has hundreds of affili- 
ates, just to leave that point with you, hundreds, maybe thousands. 

Chairman Shelby. Several thousand. 

Senator Sarbanes. Was it several thousand affiliates of Citicorp? 

Chairman Shelby. Yes. 

Senator Sarbanes. Thank you. 

Chairman Shelby. Senator Miller. 

Senator Miller. No questions. 

Chairman Shelby. Thank you, gentlemen, for your appearance 
today. We appreciate you testifying. 

Senator Sarbanes. Mr. Beales, we are going to keep after the 
FTC here. I don’t know. You keep telling us they have not decided, 
they have not decided. They have to start deciding pretty soon. 

Chairman Shelby. They are going to be behind the Committee. 

Senator Sarbanes. That is a sorry state of affairs. 

Chairman Shelby. Thank you. 

Our second panel will be composed of Michael D. Cunningham, 
Senior Vice President, Chase Cardmember Services; Captain John 
M. Harrison, U.S. Army Retired, consumer witness; Stuart K. 
Pratt, President and CEO, Consumer Data Industry Association; 
Linda Foley, Executive Director, Identity Theft Resource Center; 
William Hough, Vice President of Credit Services, The Neiman 
Marcus Group; and Michael W. Naylor, Director of Advocacy, 
AARP. 

We appreciate all of you appearing here today, if you will take 
your seats as soon as you can. 

In the meantime, I will announce again that your written state- 
ments, which will be made a part of the record in their entirety 
without objection, and these hearings are well attended, as you 
know, and very interesting. There are a lot of consequences, so you 
see the interest here. 

If you could sum up, just briefly, your top points because we have 
your written testimony, as I have just indicated, we would appre- 
ciate it in the interest of time. 

Mr. Cunningham, we will start with you. 

STATEMENT OF MICHAEL D. CUNNINGHAM 
SENIOR VICE PRESIDENT, CREDIT AND FRAUD OPERATIONS 
CHASE CARDMEMBER SERVICES 

Mr. Cunningham. Thank you, Mr. Chairman, Members of the 
Committee. My name is Michael D. Cunningham and on behalf of 
J.P. Morgan Chase & Co., we greatly appreciate this opportunity 
to appear before the Committee and share our experience with the 
issue of identity theft. I ask that my written statement be placed 
in the record. 

Chairman Shelby. It has been. 

Mr. Cunningham. I serve as the Senior Vice President for Credit 
and Fraud Operations for Chase Cardmember Services. Protecting 
our customers from identity theft and fraud is a major priority for 
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our company. We utilize both leading-edge technology and hands- 
on intervention by over 750 specially trained Chase employees. And 
we detect over 70 percent of all fraud before the customer even 
knows it has occurred, and we continue to improve on that number 
every year. 

While identity theft and what we call credit card fraud both con- 
stitute fraud, we would like to distinguish the two for policy pur- 
poses. We place identity theft into two basic categories: Fraudulent 
applications and account takeovers. Together these types of iden- 
tity theft account for 4 percent of our total fraud cases. 

Fraudulent applications constitute 3 percent of our total fraud 
cases. This involves the unlawful acquisition and use of another 
person’s identifying information to obtain credit, or the use of that 
information to create a fictitious identity to establish an account. 

This requires that the perpetrator possess a great deal of de- 
tailed information about a person and their credit history. This is 
why more than 40 percent of the identity theft cases that we see 
are committed by someone familiar to the victim, frequently a fam- 
ily member or someone in a position of intimacy or trust. 

Account takeovers constitute 1 percent of our total fraud cases. 
This occurs when someone unlawfully uses another persons’s iden- 
tifying information to take ownership of an existing account. This 
would typically occur by making an unauthorized change of address 
followed by a request for what we call a new product, such as a 
card, a check, or a PIN number. 

Non-identity theft fraud constitutes the other 96 percent of our 
total fraud cases. This type of fraud would include such events as 
lost or stolen cards, intercepted cards in the mail, or counterfeited 
cards. 

During the course of the debate on identity theft and fraud, crit- 
ics have alleged that the process known as prescreening is some- 
how a major contributor to identity theft and other types of fraud. 
This is not the case. In fact, prescreening is a major underwriting 
tool that accomplishes just the opposite. 

Prescreened offers have a very low incidence of fraud, especially 
when compared with other forms of new account generation. At 
Chase, we have 17 million active accounts. During 2002, pre- 
screened accounts subject to identity theft involved approximately 
600 accounts. Total fraud cases of all types in 2002 numbered 
about 75,000, which includes the 600 prescreening cases I just 
mentioned. Last year, prescreening resulted in 1.6 million new ac- 
counts to us out of a total of 4 million new accounts, or about 40 
percent of all of our new accounts. 

Why do prescreened cards result in less identity theft? Pre- 
screened offers of credit come from a pool of consumers selected 
from credit bureau files that have already undergone a verification 
process. Prescreened credit card offers do not contain any personal 
information other than name and address, and contain none of the 
other personal information necessary to apply for credit. Identity 
thieves do not find prescreened offers of credit very useful because 
even if they intercept one, they have to submit a change of address, 
which under our system would trigger an alert and subsequent 
analysis. 
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Finally, Mr. Chairman, we recognize that consumers may need 
help once they learn of the identity theft or fraud. Once a problem 
is identified, this sets in motion a series of consumer education and 
assistance as detailed in the two appendices in my written state- 
ment. And I also have with me a list of recommendations that we 
take great pride in. This is an identity theft kit that we mail to 
all consumers as well as customers that we determined are victims 
of identity theft. 

Also in the written statement is a list of recommendations to 
assist in combating identity theft and assisting victims. 

Thank you for considering our views on this issue, and I look for- 
ward to your questions. 

Chairman Shelby. Captain Harrison. 

STATEMENT OF JOHN M. HARRISON 
CAPTAIN, U.S. ARMY (RETIRED) 

ROCKY HILL, CONNECTICUT 

Mr. Harrison. Thank you very much. 

Mr. Chairman, Ranking Member Sarbanes, and Members of the 
Committee, I appreciate this opportunity to appear before you this 
morning to talk about my experiences as an identity theft victim. 
My name is John Harrison. I am 42 years old, a retired U.S. Army 
Captain, and I have resided in Rocky Hill, Connecticut, since my 
retirement in December 1999. I was, until recently, employed as a 
corrugated salesperson in Connecticut. 

My introduction to the crime of identity theft began on November 
5, 2001. That is the day I learned that someone had stolen my 
identity and had already used my name and Social Security num- 
ber to open numerous accounts. 

I immediately began taking those steps recommended by the 
FTC. On December 12, 2001, Jerry Wayne Phillips was arrested in 
Burke County, North Clarolina. He was indicted on Federal charges 
in Texas. He pled guilty to one count of identity theft, and is cur- 
rently serving 41 months in a Federal prison in Minnesota. 

What I learned after that was that Jerry Wayne Phillips had 
gained control of my identity when Army officials at Fort Bragg, 
North Carolina, issued him an active duty military identity card in 
my name and Social Security number. That happened about a year- 
and-a-half after my retirement. With that identity, and at the time 
I had very good credit, he was able to open what I have discovered 
was $260,000 worth of accounts. There are 61 of them at this point 
that were opened in my name. 

They are accounts of all different types. There are personal and 
auto loans, regular credit accounts with credit card companies, and 
also stores, checking and savings accounts, and utility accounts. He 
bought two trucks through Ford Credit for $85,000. He bought a 
motorcycle from Harley-Davidson for $25,000. He rented a house in 
Virginia and bought a time-share in Hilton Head, South Carolina. 

It has been 20 months since I found out I was a victim. 

Chairman Shelby. How did you find out? 

Mr. Harrison. I was called by a police officer in Beaumont, 
Texas, who was investigating the Harley-Davidson motorcycle for 
Harley-Davidson. He tracked me down through my credit reports 
and he could already tell that I was a victim of identity theft. 
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And when he called me, he told me and he set me on the right 
track. He sent me to the FTC’s wehpage, told me to contact the re- 
positories, and he was the one that got me started on the track to 
recovery. 

As I said, it has heen 20 months since I found out about it. My 
imposter has heen in jail 19 of those months, and there have heen 
no new accounts opened since he was incarcerated. So everything 
that I am dealing with still, to this day, are accounts that were 
opened between July and December 2001. I still have new accounts 
coming in. The latest was May, last month. I had a new account 
that I learned of. 

From the first day, I have been very aggressive about restoring 
the damage done in my name. I have sought out the fraudulent ac- 
counts, and in most cases I have gotten hold of them before they 
were able to get hold of me. I have encountered a great many dif- 
ficulties. Two of the repositories have done what I consider to be 
a fair job in assisting me and allowing me to dispute the accounts 
with them. One of them, Equifax, quite frankly, almost failed to 
meet any of the requirements of the Fair Credit Reporting Act. It 
took me 11 months and three dispute letters to get my second re- 
port from the Equifax. And when I did get that report, it was a dif- 
ferent report to what they were sending out to all my creditors. 
There are fraudulent accounts on both reports and there are good 
accounts on both reports. Some are the same and some are dif- 
ferent. So, I cannot even begin to dispute accounts until I get the 
report that has the accounts on it. That has been a difficulty. 

Senator Sarbanes. I want to be clear. You asked for your credit 
report and they sent you a report that differed from the credit 
report they were sending to your creditors? 

Mr. Harrison. Completely different, yes, sir. 

I had an inkling of that because I had been declined credit from 
my bank. I was getting married and I was trying to get a home eq- 
uity loan, and I declined was I called my bank and the loan officer 
talked to me about some of the accounts that were on the report. 
And I was like I am not seeing those. I thought those accounts 
were gone. But it turned out that there was a second report that 
they have that was different from the one that I had. 

Chairman Shelby. But they did not share that with you? 

Mr. Harrison. No, sir. I have since gotten it. Actually, I was 
able to get it because one of the things that happens when an im- 
poster steals your identity and starts using different addresses and 
different birth dates, is all that information on your credit reports 
changes, because the creditors are the ones who control your per- 
sonal information, not you. 

So because all that information was different, I look like the 
fraudster to Equifax. When I was asking for my credit report, I was 
asking for it from Connecticut. What was on my credit report at 
the time was an address in North Carolina or South Carolina. He 
used 17 different addresses, all of them made it through my credit 
reports at one time or another. There was six different phone num- 
bers. And like I said, even my date of birth changed on the per- 
sonal information on my credit report. 

I did want to mention the emotional impact. The emotional im- 
pact from identity theft is embarrassing to me because I have 
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always been a very strong person. The 20 years that I spent in the 
military, it was always noted that I was a person that worked bet- 
ter under stress. But what you go through as a victim in trying to 
clear this up, I mean the repetitiveness of telling companies over 
and over again, explaining your story, sending out all your docu- 
mentation, having accounts come back. It would drive anybody 
nuts. It really will. 

In my particular case, about 11 months into this, in September, 
I started having some anxiety problems and sleeping problems. So, 
I went to my doctor and I got some medicine. And that seemed to 
help me out for a few months. 

In January 2003, I had a lot of bad things happen. Besides the 
identity theft, I had the military trying to garnish my retirement 
pay because of one of the debts. And at the same time, I had my 
own credit card companies taking adverse actions against me be- 
cause of what was in my credit reports. I guess it just overwhelmed 
me and it became a real distraction for work. I went to my boss, 
explained it to him. I started doing therapy. The doctor told me I 
had Post Traumatic Stress Disorder because my flight or fight got 
stuck on fight, which made a lot of sense to me because that is 
pretty much the way I felt, like fighting everything. That eventu- 
ally led to my termination in April. I was fired from my job. I was 
a salesperson. Identity theft almost conflicts 100 percent with our 
job as a salesperson because you have to make phone calls, you 
have to write letters. You have to deal with rejection. And it was 
affecting my performance and I think my bosses felt they had to 
let me go because of it. 

I have two recommendations that I have made in my written 
statement and I would like to bring those up. Especially now, since 
I was listening to Mr. Beales and what he was talking about with 
the information sharing. 

The thing that I would say, one of my recommendations is, if I 
want to order my credit report I have to provide my name, my date 
of birth, my Social Security number, my current address, my pre- 
vious address. And if that is not enough, if there may be a problem, 
then they start going through accounts on me and I have to verify 
some of the accounts that are on my credit report. That is what I 
have to do. What a creditor has to do is give the Social Security 
number of the person that is standing in front of them. The infor- 
mation, there is information there for them to use, they just are 
not using it. 

They have an application and obviously they have asked this per- 
son to give their address and their telephone number, their date of 
birth. But all they are doing is putting in a Social Security number 
and they are getting back a FICO score, probably in a lot of cases 
not even the credit report to see the fraud alert. They are just see- 
ing a high number and they are making a deal. 

I really think that if creditors were held to the same standards 
we were, if they had to input four or five different pieces of per- 
sonal information into the credit bureaus, and if that information 
was wrong they got the same message I would get, that we cannot 
identify this person and you are not going to see the credit file, 
everything in my situation would not have happened. 
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The person did not know where I lived. He did not know how old 
I was. He did not know anything about me. He just had my name 
and Social Security number and a military identity card. So that 
would have prevented all of my situation. 

The second recommendation that I made in my written state- 
ment, and I am not doing this to get back at the credit bureaus, 
but I think that it is a good idea if the credit bureaus were rated 
for their proficiency, especially when it comes to accuracy of credit 
reports. 

My personal opinion is that the credit bureaus, while publicly 
they say identity theft is a bad thing, I think they are making a 
lot of money. In my situation alone there are over 100 inquiries on 
my credit reports from these fraudulent accounts. It is money they 
would not have made if someone had not stolen my identity. 

Also, the credit monitoring systems, as identity theft gets more 
and more out there, I do not think that there is a lot of monetary 
incentive to be aggressive about fixing this problem. If there was 
a rating system that was released, I think that accurate credit re- 
ports are as important to the creditors and soon to be insurance 
companies. And I think that the competition would help the indus- 
try repair itself. 

Chairman Shelby. Thank you. 

Mr. Pratt. 


STATEMENT OF STUART K. PRATT 
PRESIDENT AND CHIEF EXECUTIVE OFFICER 
CONSUMER DATA INDUSTRY ASSOCIATION 

Mr. Pratt. Chairman Shelby, Senator Sarbanes, Members of the 
Committee, thank you very much for this opportunity to appear be- 
fore you today. For the record, I am Stuart Pratt, President and 
CEO of the Consumer Data Industry Association. And we commend 
you all for holding this hearing on the crime of identity theft and 
its relationship to the Fair Credit Reporting Act. 

Identity theft is an equal opportunity crime that can affect any 
of us individually. This crime is particularly invasive where con- 
sumers, consumer reporting agencies, and creditors are all tasked 
with untangling the snarl of fraudulent accounts and information 
that results from the criminal’s actions. This task can be frus- 
trating, and as we have heard, time consuming for all concerned. 

The Committee has asked us to comment on the crime itself and 
on its relationship to the FCRA. In this regard, let me focus briefly 
on three points: The first of which is the FCRA does provide the 
basic framework of rights and duties that consumers need in order 
to be able to work with their credit histories, in order to have con- 
fidence in the credit reporting system, in order to ensure the data 
is accurate, and so on. 

Second, our members have been at the forefront, however, of ef- 
forts to understand the nature of the crime, and have established 
a range of victim assistance procedures, which go beyond the re- 
quirements of any law because there does need to be some customi- 
zation, some tailoring of procedures for victims of identity theft 
that are different than what you or I might go through as an aver- 
age consumer. 



105 


Third, consumer education remains, I think, a mainstay, some- 
thing that is essential in dealing with identity theft. It is not the 
silver bullet that stops the crime, but it is essential in terms of how 
we as consumers both try to prevent the crime from occurring in 
the first place, and it is also obviously very important to how we 
as victims would then deal with the crime subsequent to being 
made aware of the fact that you are, in fact, a victim. 

The FCRA is, as I said, an essential framework. It provides, for 
example, that consumers are made aware of the fact that their in- 
formation was used in an adverse decision. This, in many cases, 
will allow the consumer to then call the toll-free number, order a 
copy of their file free of charge, work their way through the proc- 
ess. And in a large percentage of cases this is easily done, this is 
quickly done, and this is done within the prescriptive 30-day period 
that the FCRA establishes for consumer reporting agencies. 

That is our task, our mission. And that is what we have to do 
under the law when it comes to resolving a consumer’s dispute. 

Consumers obviously expect their information to be accurate. We 
are tasked with that chore, not only because of what consumers ex- 
pect, and that is important to us, but also because that is what our 
customers expect. They expect accurate information. In fact, the 
law itself expects us to be accurate and we must employ reasonable 
procedures to assure the maximum possible accuracy in the file. 

Consumers, when they do dispute information on the file, obvi- 
ously expect to be notified of the results of the reinvestigation. 
They expect to have that opportunity to comment further on the re- 
sults of that reinvestigation. And those are rights that they have 
under the law today. 

We think that framework is in place. I think the goal here today, 
certainly for us, is to continue that process of discussing how this 
framework works for victims of identity theft. And to provide a 
little more context for that, let me just talk about some of the ini- 
tiatives that we have undertaken, because there certainly are in- 
stances where the basic framework is not sufficient. Identity theft 
is a longitudinal crime that occurs over a period of time. It is quite 
a bit different than burglary or other forms of crimes where I walk 
up and I see the empty parking lot, so I know my car is gone. Or 
I walk up to my home and I can see my home is burglarized. 

So, we have standardized security alerts to make sure that down- 
stream crime does not occur when an alert is on your file. And we 
have standardized the three steps we take for consumers when 
they contact us initially. 

This year we announced a single call point of entry, so a con- 
sumer has an easier time of notifying all consumer reporting agen- 
cies. The one phone call to any one of the national agencies results 
in that same data being transferred to all of the consumer report- 
ing agencies. Each agency takes the first three steps for that con- 
sumer getting the file disclosure to the consumer, opting them out 
of prescreened offers of credit, putting an alert on the file for the 
consumer. 

We have also used police reports to try to expedite removal of in- 
formation from credit reports and we do think that is an essential 
step for consumers. They want information off the file quickly. 
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They would like to have it done once and for all, I am sure the first 
time through, no doubt about it. 

My time is running out, and what I would like to do is 

Chairman Shelby. I will not let your time run out yet, but Mr. 
Harrison brought up some very serious questions that he experi- 
enced himself. I was out of the room for a minute. Can you address 
those questions? 

Mr. Pratt. Yes, sir, I would be happy to. 

Chairman Shelby. He went through a horrible experience. 

Mr. Pratt. What I will have to do, Mr. Chairman, is of course, 
I suspect, talk with Mr. Harrison a little bit more to learn more 
about the details. 

What I have heard is that the creditor had different information 
than the information that he had in his hands through the file dis- 
closure. I have to better understand what that means, or what the 
circumstances were around that. 

Here is what the law says, and here is what should have hap- 
pened. The law says we are obligated to disclose all information 
about that consumer at the time the consumer makes the request. 
That was actually an amendment to the law in 1996, to make it 
absolutely clear that we must disclose everything so that Mr. Har- 
rison does, in fact, have the same information that a lender would 
have, so that Mr. Harrison would understand precisely what was 
in the file and the lender would have the very same information. 

So, I cannot explain it further than that, but that is what the 
law requires. That is what the law always requires, and it makes 
sense to all of us in the industry that that is what the law should 
require. 

In terms of the experiences he has had individually, I have two 
reactions to it. I took a lot of notes, because every time I come to 
a hearing and hear about an experience, or spend time visiting 
with Linda or others, we do learn sometimes about practices that 
are not perfect in our industry. One, industries are big and some- 
times they do not get it right with every single consumer. 

I do believe Mr. Harrison’s experience is the aberration rather 
than the norm because of the incredible effective criminal that per- 
petrated the crime against him. This is not as common in identity 
theft. But where it does occur, it does take more time, it is more 
frustrating, it is harder to pull it all back. 

Lenders certainly have the same challenge that we have and, of 
course, concurrent with servicing the consumer who is a victim, we 
have to make sure that we are not closing down accounts that are 
not otherwise valid accounts, because a consumer just did not want 
to pay a bill. So it is a wheat and chaff process. You are trying to 
make sure you deal effectively with every legitimate claim, and at 
the same time try to deal effectively with the illegitimate claims. 

Thirty-five percent of the consumer relations process that we 
deal with through credit bureaus today is tied to something called 
credit repair. Credit repair is the process by which a consumer is 
either advised or somebody on their behalf simply disputes every 
item of information in the file that they would like to have re- 
moved. They do this, in some cases, every 15 days in order to try 
to beat down an accurate credit report. 
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And so one of our challenges is to try to make sure that we are 
always identifying Mr. Harrison properly, and at the same time 
trying to identify where we have a circumstance that might be 
credit repair related. 

It is not an excuse. I want you to understand the dynamic 

Chairman Shelby. But you are not there yet. You have not 
solved all that, have you? 

Mr. Pratt. We have not solved all of those problems, no, sir. We 
are progressively, when you look at our testimony, we have out- 
lined a whole series of steps we have taken which I think indicate 
that we recognize that you cannot look at your law and say well, 
the law said this and so we are done. That is it. We are finished 
with this. Our job is done if we did it the way the law required. 

We found a lot of things that we needed to change over time, the 
most recent of which is this one-call service because consumers 
said I do not even know necessarily what all the credit bureaus are 
that are out there. It would sure be nice if I could just call one and 
know that everybody does the same thing for me. So that was a 
new service that we launched for consumers who are victims of 
identity theft at the beginning of this year. 

Is that the final word? No, sir, I suspect that is not the final 
word. That is the best word I can give you right now, in terms of 
where we are. 

If I could just outline some things that I think would help us, one 
of which is the FTC needs the support to continue developing the 
sentinel system. Law enforcement uses the sentinel system to in- 
vestigate and to bring together those cases that can then be worked 
at the local, municipal, and the State levels by enforcement agen- 
cies at those levels. The sentinel system is a compilation of data 
about identity theft crimes from all over the country. So the FTC 
needs that support, and we believe very strongly that is an essen- 
tial ongoing element. 

I think the FTC needs to receive a lot of support in terms of con- 
tinuing to educate consumers. Mr. Harrison received information 
that I hope was helpful to him. Obviously, it was not helpful 
enough to solve the entirety of the problem for him, but it was 
hopefully a good enough stopping-off point. 

Groups like Ms. Foley’s certainly cannot always address every- 
thing in the marketplace on their own, and the FTC does a great 
job of educating consumers. 

We need to work toward resolving the multi-jurisdictional prob- 
lems we have with this crime. We cannot get consumers to get 
police reports everywhere in this country. If we could, we could ex- 
pedite a lot of data removal from files because we could use the po- 
lice report to remove data from files today. That is our initiative 
today. That is our voluntary standard today. 

We would like to get the fraudulent data off the file once and for 
all. We would like to get it off just as much as the consumer does, 
and candidly just as much as our lending customers would, as well, 
so they are making good lending decisions and they are saying yes 
rather than no. 

And we would like to ensure that there are national standards 
for our reinvestigation processes. It is one of those provisions of the 
uniform standards that we are now discussing here in the larger 
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context. We believe that those national standards do help us to 
build databases and build systems that allow us to effectively serve 
the consumer wherever they are in the country. 

With that, I will close my remarks. Thank you, Mr. Chairman. 

Chairman Shelby. Ms. Foley. 

STATEMENT OF LINDA FOLEY 
EXECUTIVE DIRECTOR 
IDENTITY THEFT RESOURCE CENTER 

Ms. Foley. Thank you very much, Mr. Chairman. My name is 
Linda Foley, and I am the Founder and Executive Director of the 
Identity Theft Resource Center. We are a nonprofit, national-based 
organization. We work with a national clientele and are based in 
San Diego. 

Sitting behind me, and you might have seen him passing me a 
couple of notes already, is our Co-Executive Director, Jay Eoley, 
who also happens to be my husband. 

I found out about identity theft when I became the victim of 
identity theft. In the last few years, our program has grown, unfor- 
tunately, due to experiences like John Harrison. And through 
learning from John Harrison and many, many other victims of 
identity theft. This chair is actually filled with the 700,000 victims 
of identity theft this year that we abstractly represent, that is the 
number we use — so we have learned a lot about this crime. 

I have provided testimony for the Members. I am not going to re- 
peat any of it. I trust you will all read it when you have time. What 
I would like to address is some of the things that I have been hear- 
ing today. 

If anyone in this room thinks they are immune to identity theft, 
especially any of the Senators, let me please point out that you 
have a book downstairs in the gift shop called the Capitol Guide. 
It is a little long book — ^you even get a $5 phone card in it now — 
which lists your birth date and your place of birth. Depending on 
whether you have an open or closed access State, I could get your 
birth certificate without much effort. Erom that it is a hop to call- 
ing the Social Security Administration and getting your Social Se- 
curity number. Basically, they ask a few questions based on your 
birth certificate information. I now have your Social Security num- 
ber. With this I now have access to your credit and to your lives. 
I can open up credit cards in your names. I happen to know what 
States you are from. It probably would not take much effort to find 
out an address. With that I can also commit criminal identity theft 
in your name. 

No one is immune from identity theft from birth, since we now 
give Social Security numbers to infants, to beyond death. 

In our testimony you will find 20 case histories from our records 
that I have itemized, including cases of child identity theft. It in- 
cludes a 6-year-old who owes over $60,000, including almost $5,000 
in child arrears to himself, by the way, and has three DUFs. He 
cannot even see over the steering wheel yet. Daddy dearest is an 
illegal immigrant who, now divorced from his American wife, must 
use his child’s identity in order to somehow figure out a way to 
stay legally here in the United States. 
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Last year you all probably read in the New Jersey Star Ledger, 
the article of the woman who was contacted by an insurance com- 
pany. They wanted information about her husband’s auto accident. 
Interesting. Her husband had died 10 months earlier on September 
11, on the 80th floor. 

Those are some of the more poignant stories. 

One of the remarks made today is that John is not the norm. We 
get about 40,000 visitors to our website per month. Those are num- 
bers of people who come and read information, gather information, 
and hopefully have enough to go on and work on their own. ITRC 
gets about 100 to 150 telephone calls or e-mail letters each week 
from people like John who we call extreme cases. 

His is typical of our extreme cases. This is not an aberration. In 
fact, we have cases much worse than John’s, unfortunately, that we 
deal with. 

Family identity. Senator Dole, you mentioned that, 40 percent 
are family oriented. Those are the ones I get. No one in the office 
wants to take them because they have to deal with, “what do I do?” 
Do I turn my mother over to the police? Would I be a bad child 
to do that? Am I a bad daughter? Am I a bad parent if I turn my 
child over to the police? How do I deal with this within the family? 
How do I convince the credit reporting agencies? How do I convince 
credit issuers I did not open up these accounts if I am not willing 
to file a police report? 

We have a problem in that in many jurisdictions throughout the 
United States, the police are still reluctant to take police reports. 
California has a law. Penal Code 530.6, which says that a police 
report must be taken in the jurisdiction where the victim lives. 
That is not true in many cases, and these victims get bounced from 
place to place. They live in Alabama and the crime is occurring in 
Kentucky. Who is going to take the police report? Alabama is not 
going to send someone to go investigate. 

And I will go back to one other thing. A lot of times victims need 
these police reports to help clear up the credit issue. The reality 
is when I speak with victims, I am trying to explain to them you 
may never see an arrest out of this case. In fact, very few are. 

We have talked about penalties several times. Increasing pen- 
alties is important, but we are basically increasing penalties for all 
those people who are never arrested, which could be in excess of 
90 percent. 

Chairman Shelby. Ms. Foley, the question Senator Sarbanes has 
proposed, how do we prevent it, right? 

Ms. Foley. Correct. 

Chairman Shelby. How do we tighten down on it? 

Ms. Foley. I think it comes down to three areas. We need to stop 
letting criminals get information by better business handling. I just 
finished writing a book on that and we are talking about it with 
businesses. Not everything needs to be legislated. I think a lot of 
it is common sense. Why are businesses throwing information in 
dumpsters behind their stores that has personal identifying infor- 
mation? Do we really need to legislate against it? I know we have 
in Georgia. We have in California. We have shredding laws now in 
both of these States. But must we really tell a business, do not 
carelessly throw away a piece of paper that has someone’s Social 
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Security number on it. You would not want that done to you. It is 
called the Golden Rule. 

I think we need to understand this crime links to other crimes. 
We need to consider that if they are going to get the information, 
we need to prevent them from being able to use it as readily as 
they do. I have provided for Senator Sarbanes’ benefit as well as 
all of yours, almost 20 recommendations for laws that I think are 
necessary and that we need to see. I would like to see them on a 
national basis. We have seen more flurry of activity and talk at the 
Federal level in the last few months since we have been talking 
about FCRA than we have in the last 6 years since I have been 
a victim of identity theft. Yet, I see very few laws being passed. 

Senator Feinstein has a bill, S. 1399, which has been around 
since 2000. It is a mandatory observation of fraud alerts. The credit 
reporting agencies do allow us to put a fraud alert on their credit 
reports. There is no law that says that a credit grantor must honor 
it, however. We have victim after victim who says, “I put a fraud 
alert on my credit report. I even sent a letter in to them asking 
for the 7-year alert,” because they have been gracious enough to do 
this without being Federally mandated to do so. But the credit 
issuers are not observing them. 

Someone mentioned the movie “The Net.” I happen to be partial 
to the movie “Class Action,” an old Gene Hackman movie. It is 
more financially beneficial to these companies to ignore those fraud 
alerts and to quickly get the money, to open up the line of credit 
within 30 seconds — our microwave society — than it is to take the 
time to call and verify that application. 

We just recently got cell phones. We have fraud alerts, both of 
us. That fraud alert took an extra 10 minutes for us to get that cell 
phone. That is all it took, one phone call. My husband, he got it — 
and if we had had our cell phones already we could have had them 
just call the cell phone and I would have waved at the car dealer 
across the table from me and said, hi, this is me. Yes, go ahead and 
approve the application. It is as simple as that. 

You asked about our position regarding FCRA and the preemp- 
tions and the sunsetting. I think I would like to summarize it in 
a couple of ways. Yes, there is a need for strong national laws. 
There is no question about it. However, the framers of our Con- 
stitution said this is a framework. The FCRA was devised as a 
framework for privacy as well as ways information is being han- 
dled. It was never supposed to deal with every single issue. 

If you are asking us to say, shall we go ahead and renew the pre- 
emptions, without having the laws already in place that are going 
to resolve all of the problems that you are all talking about al- 
ready, how can we do that without knowing whether it is going to 
take care of the problem? Will we need to rely on the States, who 
are more responsive at this moment and have passed more laws, 
and have been dealing with the issue on a continual basis in many 
cases? We do come from California. Unfortunately, we do have the 
most number of victims. But we have also passed a great number 
of laws. We also have high population groups which attract these 
criminals. 

We are going to take a position right now which is — we want to 
see what these laws are that you are going to pass, and that are 
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going to get signed and put into action. To discuss preemptions in 
FCRA — we are not talking about renewing the whole FCRA but 
just those seven areas of preemption right now — is premature. How 
can we say that we do not want affiliate sharing? How can we talk 
about any of these other areas when we do not know how the laws 
are going to deal with it? 

We have another problem. If we have a Federal law about iden- 
tity theft, then why did we have to pass laws in every State? It is 
because local law enforcement, local jurisdictions need some lati- 
tude for them to be able to prosecute as well. So if we are going 
to create national laws, we need to also keep in mind that we have 
to be able to enable local law enforcement and local district attor- 
neys to be able to work with the Federal system. Otherwise you are 
going to have every U.S. Marshal, every U.S. Attorney, and prob- 
ably half the Army, the Navy, and the Marine Corps working to in- 
vestigate identity theft and prosecute. We do not have the staff to 
do it all on the Federal level. We have to expand that all. 

I do have a couple of questions, first Stuart, please. I know that 
you have the one-call shop now. I also know that we have a prob- 
lem because each of the credit reporting agencies have different 
standards of information that they ask for on their automated sys- 
tems or through their live person, in one case. How have you re- 
solved that? Have you finally come to an agreement on what data 
is going to be needed, or if I call Equifax are they going to ask for 
one set of information and then Experian may contact me later on 
and ask me for a couple more pieces of information before they 
send my credit report? 

Chairman Shelby. We generally do not let our panelists ask 
questions. 

[Laughter.] 

Ms. Foley. Sorry. 

Chairman Shelby. Except that was a good question. 

Ms. Foley. It is a problem we are hearing about. 

Chairman Shelby. Why don’t we finish the panel before we 

Ms. Foley. I would appreciate that. 

Chairman Shelby. We are going to go to Mr. Hough. 

STATEMENT OF WILLIAM HOUGH 
VICE PRESIDENT OF CREDIT SERVICES 
THE NEIMAN MARCUS GROUP 
ON BEHALF OF THE 
NATIONAL RETAIL FEDERATION 

Mr. Hough. Thank you, Mr. Chairman. Good afternoon. My 
name is Bill Hough and I am Vice President of Credit Services for 
The Neiman Marcus Group. I am testifying today on behalf of the 
National Retail Federation. I would like to thank Chairman Shelby 
and Ranking Member Sarbanes for providing me with the oppor- 
tunity to testify about the growing problem of identity theft and 
the steps that Neiman Marcus, like so many other members of the 
retail community, is taking to curb our losses and protect our cus- 
tomers from these crimes. 

By way of background. The Neiman Marcus Group is head- 
quartered in Dallas, Texas, and it is comprised of two operating 
segments. Special Retail, which includes the Neiman Marcus stores 
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and the Bergdorf Goodman stores, and Direct Marketing, which in- 
cludes the catalogue and online operations of our Neiman Marcus, 
Horshow, and Chef’s brands. We issue our proprietary credit cards 
under the Neiman Marcus and Bergdorf Goodman names. 

In fiscal 2001, Neiman’s reached the high-water mark for iden- 
tity theft related losses with over 520 cases representing a total ex- 
pense of $1.3 million. In the past 2 years, we have experienced a 
decline of 70 percent in the number of identify fraud cases with 
less than 150 cases projected for the current year. It is important 
to note that other fraud related cases such as lost or stolen credit 
cards have remained constant over the last couple years. 

Mr. Chairman, instant credit applications represent about 85 
percent of all accounts open at Neiman Marcus. These are handled 
at the point of sale. In order to cut down on fraud and identity 
theft during the application process, Neiman’s developed a custom 
fraud detection model that analyzes certain specific attributes of 
every credit application. This system isolates certain variables on 
an application and double-checks them against information found 
on the applicant’s credit report. Where discrepancies and inconsist- 
encies occur, the model sends the application to our credit depart- 
ment for review. Clearly, the model has worked well for us over the 
last couple years. This year we know we have prevented about 800 
fraudulent accounts from being opened. 

Occasionally, we are able to definitively detect an attempted 
fraud and arrest an identity thief in the store. This usually occurs 
if our credit office, after being alerted during the application proc- 
ess, can quickly get in touch with the victim. We will then ask 
them if they want to pursue an arrest of the person attempting to 
open the account in their name. If they agree, we will detain the 
suspect and contact the police. We have had 33 such arrests this 
year and 80 last year. 

Currently, Neiman Marcus Direct, our catalogue division, and 
our stores send out 15,000 packages a day delivering items to cus- 
tomers. By using customer information-sharing, we were able to de- 
velop an address delivery cross-check within our Delivery Manifest 
system. What that does is it double-checks against any negative 
addresses that may be out there to detect possible bad deliveries. 
Additionally, we have edits in place to identify unusual buying pat- 
terns that may be forwarding merchandise to certain addresses 
multiple times. These controls have stopped about 500 fraudulent 
shipments in the last year. 

Neiman’s also does special edits to focus on the hottest selling 
merchandise. In fact, a savvy salesclerk in our Neiman Marcus 
White Plains store helped expose one of the largest identity theft 
rings in U.S. history involving a former employee of Teledata and 
over 30,000 stolen credit reports from the three major bureaus. The 
incident began when a woman called in an order for $6,000 in 
trendy shoes to the White Plains store. She told the salesclerk she 
did not care what size the shoes were and where they were to be 
shipped. The salesclerk realized this was suspicious, notified our 
Loss Prevention department. They, in turn, set up a controlled de- 
livery with local law enforcement and the postal authorities. 

Mr. Chairman, I would like to be able to tell you that Neiman’s 
has prevented 100 percent of all fraudulent credit applications this 



113 


year, but I cannot. Successful identity thieves still slip by our sys- 
tems at the rate of 7 for every 10,000 applications processed — less 
than one-tenth of 1 percent. This, in my view, is not the result of 
a flawed system, but the result of determined criminals with 
sophisticated tools like computers and the Internet. The most suc- 
cessful identity thieves know how to replicate an individual’s iden- 
tity perfectly. They also know how to get a hold of what I would 
call perfectly identifiable pieces of information which may be a 
driver’s license or a counterfeit credit card. 

For these types of criminals there is very little else we can do 
to detect and prevent the crime, and retailers, like other busi- 
nesses, are loolang to the States and the Federal Government to 
begin producing the most secure identity documents possible. 

The need for tougher law enforcement statutes is also critical. 
While we will arrest approximately 250 perpetrators of fraud this 
year, many of these criminals are out on the street the next day 
with a slap on the wrist. Identity thieves are treated as a harmless 
pickpocket instead of a serious criminal who has created havoc for 
an innocent victim. These people, especially those that become mul- 
tiple offenders, must face stifer sentences if we are going to stop 
this type of crime. 

Further, identity thieves thrive on anonymity and rely on the as- 
sumption that large retailers such as Neiman’s cannot put a name 
and face together in order to prevent fraud. This is why it is so im- 
portant for retailers to know their customers, and why it is so im- 
portant that we have to do this by the efficient use of information. 
Information flows between Credit Services and the bureaus, or be- 
tween Retail Divisions and Marketing Divisions, combined with so- 
phisticated technology and scoring models, cut down on fraud and 
allow us to offer better customer service. 

In conclusion, if there was one thing I want to point out as I 
leave, it is oftentimes our efforts to provide customer service have 
led to new mechanisms by which we do stop fraud. Identity theft 
is a crime with at least two victims: The individual whose identity 
was stolen and the business from which money and merchandise 
was stolen. Clearly, it is the individual victim that is most directly 
hurt. But if identity theft crimes continue to rise at the rate re- 
ported by the FTC, all consumers will ultimately pay as much of 
these business losses are passed back to the consumer. 

Mr. Chairman, I ask that Congress think carefully before block- 
ing information flows or constraining businesses to specific preven- 
tion techniques or responses. We, in business, must continue to 
have the leeway to innovate to respond to constantly changing vari- 
ables. Criminals always find a way and we need to maintain the 
ability to find a response. I thank you for your time. 

Chairman Shelby. Mr. Naylor. 

STATEMENT OF MICHAEL W. NAYLOR 
DIRECTOR OF ADVOCACY, AARP 

Mr. Naylor. Thank you, Mr. Chairman, Senator Sarbanes, and 
other Members of the Committee. I am the last batter in the bot- 
tom of the ninth and I can feel the palpable hope in this room that 
I will pop up on the first pitch. So let met at least 

Senator Sarbanes. Or hit a home run. 
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Chairman Shelby. The bases are loaded. 

[Laughter.] 

Mr. Naylor. Let me just, in a fragmentary way, touch the high 
points here. 

First of all, I am new to the position at AARP and I hope that 
if there is anything we can do on this issue, or any other issue, to 
help you with your important responsibilities, you will not hesitate 
to call on us. 

Second, I enjoyed Senator Bennett’s asides with regard to some 
of the popular culture forays in Hollywood and others into this 
issue. You might want to add to that. Senator, the New Yorker car- 
toon from about 2 months ago where a man is disconsolately telling 
his friend, my wife ran away with the guy who stole my identity, 
which is maybe a problem that has not surfaced yet. 

At AARP, we suspect that our members may be more prone to 
be victimized by these crimes than others. They control more of the 
Nation’s wealth. They have a longer credit history, which permits 
more forms of access. Many of them are in the position where care- 
takers, custodians, or family members could take advantage of 
them. It is difficult for us to confirm that though from existing 
files. The best database is maintained by the FTC, the complain- 
ants database, which shows us no more likely, our members no 
more likely than others. But there are some problems with that. 

Number one, to get into that database you have to be a complain- 
ant. Our long experience is that older Americans are less likely to 
complain to a Federal agency than others. 

Number two, you have to offer your name. About 30 percent of 
complainants — not name, age. About 30 percent of complainants do 
not offer their age. Both from our experience and the lighthearted 
remarks by the Chairman and by Senator Schumer earlier would 
confirm that it is the case that once you get into AARP territory 
you are less likely to volunteer your age as well. So, we are trying 
to address that issue. 

Despite those biases, or omissions which under-report the experi- 
ence of senior Americans as victims, still that database shows us 
that there are six specific identity theft crimes where older Ameri- 
cans are statistically more likely to be the victim of a crime. Num- 
ber one, these are, the use of a victim’s existing credit card account. 
Number two, the establishment of a new credit card account in the 
victim’s name. Number three, the opening of a wireless telephone 
account in the victim’s name. Number four, the use of a victim’s 
information to commit credit fraud. Number five, the taking out of 
a personal or business loan in the victim’s name. And number six, 
the theft of a victim’s identifying information and then the use of 
it in attempts to commit fraud. 

There were some questions about solutions. Frankly, so far the 
AARP has spent more time in terms of trying to make its members 
aware of what is going on, and provide them practical information 
about how to avoid identity theft, and how to deal with it when it 
occurs. But we are beginning to inventory some possible solutions. 
While I cannot endorse them fully, I think there are things that we 
will continue to explore and we hope that the Committee will take 
that into account. Some of them include. Senator Sarbanes, first, 
the ability to get a free credit report once a year. That is something 
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that we will support, and my enthusiasm for it grew with every 
question you asked Mr. Beales, so we would like to press ahead on 
that count. 

Second, I do not know if we are in favor of hanging either pick- 
pockets or identity thieves, but looking at the statute of limitations 
in this regard I think is important. It may not fall under the juris- 
diction of this Committee, but it is essentially 2 years. The way the 
courts have interpreted it, that statute starts ticking from the date 
of the event. Now maybe that makes sense where someone walks 
up to you, sticks a gun in your ribs and relieves you of your wallet. 
As Mr. Harrison’s case explains, it could take weeks, months, even 
years in many cases before you know that the crime has occurred. 
So having the statute of limitations start ticking from the discovery 
of the purported crime as opposed to the date of the alleged crime 
would make a lot more sense in this regard. 

Third, Mr. Harrison’s commentary did it a lot more graphically 
than I can, but we are also very sensitive to the notion that, in gen- 
eral, it is much harder for almost anyone other than you yourself 
to get a copy of your credit report. You have to provide much more 
information to find out your credit report than almost anyone else, 
and it generally costs you more to get it. Something that addresses 
that issue I think is well within the realm of things this Committee 
could do. 

I do not know, maybe that was a scratch single, but the inning 
is over and thank you very much. 

Chairman Shelby. Thank you very much, Mr. Naylor. I will try 
to be as quick as I can. 

Captain Harrison, we heard your story here and I think it is 
compelling. Things still worked out terribly. Would you say that, at 
a minimum. Congress has a responsibility to take steps to help fu- 
ture victims like yourself? 

Mr. Harrison. Absolutely, sir. I do. 

Chairman Shelby. Ms. Foley, I am going to let him answer your 
question on somebody else’s time. 

Ms. Foley. He does it all the time. 

Chairman Shelby. Ms. Foley, we have heard testimony that the 
credit card companies employ numerous antifraud measures. I 
think this is definitely positive. However, the larger question does 
not bear on how much they do, it relates to how successful they are 
in this undertaking. Who is ahead of whom here, the people who 
commit fraud or the credit card companies, in your judgment? 

Ms. Foley. The criminals are always ahead. This is an evolving, 
changing crime. They are, at least, several years ahead of us on the 
learning curve. There is no question about that. I think that if 
credit issuers would start to accept some of the business solutions 
that are out there as far as verification of the application, applica- 
tions can be verified in 30 seconds. We are, again, that microwave 
society. People want it done quickly. 

But I have seen credit applications where only half the informa- 
tion is filled in. I know part of the problem Stuart is having and 
some of what you were talking about is — we have all done it. We 
have filled out an application halfway because we wanted the free 
gift that they were giving. What do the credit reporting agencies 
do with that information? It doesn’t quite match anybody’s real 
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credit report. They do the best match possible. That is where some 
of what we call those suppressed files come from, which is where 
there is some inaccurate information that they do not know where 
to put it. Does it go to your credit report, my credit report. Senator 
Sarbanes’ credit report. They do not know. 

Chairman Shelby. Mr. Pratt and Mr. Cunningham, I will direct 
this question to you. How does someone open 61 accounts in light 
of the precautions that the credit card companies and the credit bu- 
reaus take? 

Mr. Pratt, how do they do it? 

Mr. Pratt. Apparently they are good criminals in terms of what 
they do. I do not mean that flippantly 

Chairman Shelby. I know that. 

Mr. Pratt. — ^but there are some who are very good at it. 

Chairman Shelby. It is a very serious question. 

Mr. Pratt. Precisely. I think the short answer is, we do not 
know how often that criminal — and Ms. Foley references something 
that is a challenge. When data comes into the credit reporting sys- 
tem, we cannot cross-check a Social Security number against a 
name, against the Social Security Administration’s database. There 
are lots of good reasons why the private sector does not have access 
to that database. But that data comes in, so there may be a credit 
report under a different name but the same Social and a different 
address. There may be actually accounts opening up on several dif- 
ferent reports, so they are actually not being opened up solely on 
a single report. 

Chairman Shelby. Shouldn’t that trigger something, maybe a 
watch or caution, a little yellow light there? 

Mr. Pratt. Only if there is something connected together in all 
of that would there be some caution flag, if you will, that would 
come up in all of that for a lender, for example. But today, to give 
you some idea of the scale of change in the database, 40 million 
consumers are moving every year so it is difficult to say an address 
change alone is enough. We have 3 million marriages and divorces, 
a majority of those end up with a change in your last name. We 
have about 6 million consumers with a second home in this coun- 
try. That again results in a second address on your file. We have 
tens of millions of consumers in this country that use one of their 
credit cards for billing purposes at work, so they have a work ad- 
dress associated with their personal information. 

Managing 200 million files and 2 billion data elements 

Chairman Shelby. You are not saying that is impossible, are 
you? You are in the business. 

Mr. Pratt. I suppose with enough time and money, anything is 
possible. Senator. But I just wanted to set the context here because 
sometimes we react viscerally to this and we go, how could you not 
have seen that? The answer is, in some cases, because we are man- 
aging an extraordinarily large volume of data, so the pattern that 
you and I see here today, this seems very obvious something was 
happening, is not nearly as obvious in the large-scale sense when 
you are building a nationwide system. 

Chairman Shelby. Ms. Foley wants to respond. 

Ms. Foley. My understanding is that the repositories are not in 
the business of looking for these alerts. They are not sitting there 
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looking to see, have 61 applications come through in the last 
month. That is the job of the lenders. Unfortunately, the lenders 
do not see the full credit reports in most cases. They get a score. 
They say, gee, this person seems to have a good credit status. Let’s 
go ahead and give them a credit card. Or in John’s case, his score 
went down. It varies from credit report to credit by 150 points. 

Chairman Shelby. Mr. Pratt, I do not want proprietary informa- 
tion, but your people get a lot of money to manage this information. 

Mr. Pratt. It is a successful business, yes, sir. 

Chairman Shelby. It is a successful business. We know that. 

Captain Harrison, again, of the 61 fraudulent accounts that were 
opened on your file, how many creditors sought to pursue criminal 
sanctions against Mr. Phillips? 

Mr. Harrison. The only one I know of is Harley-Davidson. A lot 
of them that I talked to, especially after he was caught, I let them 
know who the guy was, what his name was, what jail he was in. 
Even the timeshare in South Carolina, which was $21,000 said, we 
are not going to go after the guy. It does not make sense for us to 
press any charges against him. 

Chairman Shelby. We have some very patient Senators here but 
I want to get in one more question if I can. This would be to Mr. 
Pratt, Mr. Cunningham, and Mr. Hough. Do you think consumers 
should be able to take steps to protect themselves against identity 
theft? It is what we are talking about. If they want to take meas- 
ures but those measures may have consequences that bear on the 
availability of credit, who do you think is best able to gauge those 
consequences, the companies you represent or the consumers them- 
selves? Go ahead. You all first and then Ms. Foley. 

Mr. Pratt. Our reaction is, of course, we all should know how 
best to protect ourselves, and I think there are a lot of different 
ways to do that. Some are voluntary. If you believe you have been 
a victim of a crime and you are concerned, we will put a security 
alert on your file. That is a protective measure. It will work down- 
stream to alert subsequent users of the fact that something has 
happened to the file. So in that case, yes, sir, we think that is a 
good step. But there is a consequence to that. I have actually had 
consumers complain to me that the alerts worked too well. That is 
the flip side of it as well, I guess. 

Chairman Shelby. I do not believe they are working too well. 

Mr. Pratt. I can respond to that, actually, if I may. That is, we 
have looked at 5,500 credit reports recently with security alerts on 
them because of the concerns that have been raised about how inef- 
fective they may be or how often there might be a problem. We 
looked at those files in terms of how many of those files had, after 
the alert was added, additional activity, meaning new accounts, 
how many did not, and then how many went through a reinvestiga- 
tion, which would be our best indication that a consumer had said, 
I have to pick up the phone, I have to dispute something, some- 
thing is wrong with that file. 

Less than one-half of 1 percent of all of those 5,500 files had a 
subsequent reinvestigation after the alert was added to the file. So 
that was our first look at this question because we were concerned 
about alerts on the file and whether or not they worked properly. 
That gives us one barometer which is, there is a very, very low rate 
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of dispute, even when the alert has heen on the file as much as 12 
months, and even when a file with an alert has had credit activity 
subsequent to the alert being placed. 

Chairman Shelby. Ms. Foley, do you want to respond? 

Ms. Foley. There should not be any activity once an alert has 
been placed, at all. If I say, I want to be called every time an appli- 
cation is submitted in my name, I should have that right. That pre- 
vents me from having to purchase a credit monitoring service for 
$79.95. It also prevents me from having to reorder credit reports 
over again at a cost of $8 each in order to do that, and to see what 
is going on. And I do not have to wait 12 to 15 months to find out 
if I am a victim yet again. 

There is a trade-off with a fraud alert. I did it with the exact 
knowledge that this was going to slow down the issuance proce- 
dures and process. I am a victim of identity theft. Take 2 or 3 days, 
or take a week to grant me credit, please. Just do not grant it to 
my imposter again. 

Mr. Pratt. To be clear, Mr. Chairman, I think that the file activ- 
ity that we see with new accounts is, in fact, tied to the fact that 
some consumers who are victims continue to have a need for credit 
and apply for credit, and they go through the process and the 
verification takes place, including the kind of re verification — and in 
other cases consumers are inactive, and they do remain inactive 
and that is their choice in the marketplace, and that is why some 
files have activity and some do not. In all of those cases, less than 
one-half of 1 percent ever had an additional reinvestigation, even 
as long as 12 months after the initial alert was placed on the file. 

Chairman Shelby. Senator, thank you for your indulgence. 

Senator Sarbanes. Thank you. Mr. Chairman. I will be brief. I 
just want to try to clear away a few things that may appear some- 
what minor, but let me see if I can get it settled. Is there any one 
at the table who would be opposed to a requirement that people be 
able to get their credit report free at least once a year? 

Ms. Foley. I have no objection. In fact, I would encourage it. 

Mr. Hough. I do not know what the overall expense or impact 
it would be to the credit bureaus, but I think the information is 
valuable if the person can get to it. 

Senator Sarbanes. Everyone is supportive. 

Mr. Pratt. No, sir, we are not. 

Senator Sarbanes. You are not supportive. Why not? 

Mr. Pratt. We are supportive of access. The 1996 Amendments 
provided what we thought was the right balance for access. Con- 
sumers who suspect fraud can get access to a free file. If you are 
unemployed and seeking employment, if you are on public assist- 
ance and you wish to have your file, or if you have been declined 
credit, if you are potentially going to have adverse action taken 
under employment circumstances, you have access. The 1996 
Amendments created a much larger set of what we thought were 
discrete populations of consumers with a higher level of need where 
you would not want the price to be an impediment. 

Senator Sarbanes. So, you do not think that I should be able to 
get a credit report free once a year? 
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Mr. Pratt. We think your right of access is unquestioned. The 
fee that we are getting right now is not to create a revenue stream 
for us but just to offset the administrative expense. 

Senator Sarbanes. Now, Maryland requires you to give me a free 
credit report every year, correct? 

Mr. Pratt. Yes, sir, absolutely. 

Senator Sarbanes. So, I can get it. 

Mr. Pratt. Yes, sir. 

Chairman Shelby. I cannot. 

Senator Sarbanes. Would you be in favor of dropping the pre- 
emption requirements in this statute? 

Mr. Pratt. We hope that that is not what we are moving toward 
here in the deliberative debate, but I would be happy to share with 
you the one risk that 

Senator Sarbanes. It is related to the substantive standards of 
protection for the consumer, is it not? 

Mr. Pratt. We believe access is certainly related to the sub- 
stantive standards. 

May I have a minute to just try and lay out at least one of the 
reasons for our concern, sir? That would be, for example, we have 
talked a little bit about security breaches. Credit bureaus right now 
are much more exposed — one of our reasons for concerns with free 
files has to do not so much with a principle of cost, if you will, but 
with a reality in the business world. That is, for example, when 
TriWest had its hard drives stolen in Arizona, which was a medical 
provider for the military, at least a health care service provider, 
TriWest sent out a letter to the 500,000 families. Of the 500,000 
families, at least 365,000 of them responded, calling the credit bu- 
reaus asking for various services, which the credit bureaus pro- 
vided 100 percent free of charge for every one of those security 
breach victims. 

The same thing happened with 200,000 in California. There was 
a DPI case recently with 8 million potential breaches of account 
numbers; 50,000 consumers at the University of Texas. 

Our concern is that in some ways credit bureaus are now being 
asked to bear the burden of someone else’s failure to protect their 
information in the marketplace. That really is the issue of unfair- 
ness that concerns us most. It makes it almost impossible for us 
to manage our consumer relations process for all the average con- 
sumers who are calling us every day. In fact with the TriWest case, 
each of the credit bureaus incurred approximately $1.5 million 
worth of cost even though they had no involvement, even though 
it was not credit bureau data, and even though the TriWest com- 
pany is not, in fact, even a customer of the credit bureaus. 

So our concern with that is that it is exposing us to a different 
level of risk in the marketplace. 

Senator Sarbanes. Mr. Pratt, do you favor changing the statute 
of limitations? The statute of limitations now is that a victim must 
bring legal action under the existing statute of limitations from 2 
years after occurrence of the fraud. Do you support that standard 
or would you be in favor of changing it as has been suggested here 
this morning? 

Mr. Pratt. We have been involved, certainly in the last Congress 
and I suspect heading into this Congress as well, in a constructive 
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discussion with Senator Cantwell’s staff. You will see in that bill 
a proposal which is much closer to one we feel we could work with. 

Senator Sarbanes. Which is what? 

Mr. Pratt. Well, it establishes a different time mechanism for an 
identity theft victim versus the average consumer in the market- 
place because there may be unique circumstances for identity theft 
victims. 

Senator Sarbanes. What is your time frame for the identity theft 
victim? 

Mr. Pratt. The time frame that Senator Cantwell was proposing 
was, I think it was a 3- or 4-year standard rather than a 2-year 
standard. 

Senator Sarbanes. From when? 

Mr. Pratt. From the date the event occurred. 

I would like to clarify, however, that unlike many other 

Senator Sarbanes. On the one hand, you will not let me get a 
free credit report, and on the other hand you put me into a statute 
of limitations framework which is when the event occurred, not 
when I found out about the event. 

Mr. Pratt. Could I clarify that, Mr. Chairman? 

Actually, the triggering of your liability for a credit report is 
when you are harmed, not when I put the data in the file. I could 
have data in the file that is inaccurate for 3 years, but the date 
of the event that gave rise to your harm is the date that the credit 
report was produced and you were declined or otherwise harmed. 
So, you often learn about the event, meaning your harm, through 
the adverse action notice. 

Senator Sarbanes. Do you always learn about it? 

Mr. Pratt. The world is not perfect, sir, but our belief is that be- 
cause of the way the consumer 

Senator Sarbanes. Who should the burden be upon to make the 
world more perfect in this regard — the lonely consumer or the busi- 
ness network that is engaged in these practices? 

Mr. Pratt. In our review of case law, a very small percentage 
ever deal with the statute of limitations. Consumers appear to be 
successful in bringing cases. They do bring cases every year, and 
certainly litigation has ensued since the 1996 Amendments. 

Senator Sarbanes. I take it one of the AARP’s lead recommenda- 
tions is on the statute of limitations. Is that correct, Mr. Naylor? 

Mr. Naylor. That is correct. Senator. 

Senator Sarbanes. Mr. Cunningham, what is your view on this 
free report once a year? 

Mr. Cunningham. I believe that it is a question that should be 
answered by the credit bureaus more than by myself. I am not nec- 
essarily in a position to say whether or not it is the right thing to 
do economically or not. 

Senator Sarbanes. Mr. Chairman, I have another question. 

Chairman Shelby. You go ahead. 

Senator Sarbanes. Just a week ago in the American Banker 
there was an article, “Setting New Policies To Catch Identify 
Thieves.” It reports that starting July 1 all businesses in California 
will have to tell customers when the security of their personal in- 
formation has been breached. If a bank suspects that someone 
could have stolen a Social Security number, a driver’s license, or 
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bank account numbers, it must inform the customer. Is there any- 
one at the table who feels it is undesirable to enact such a law 
nationally? 

Ms. Foley. We supported, Senator, a piece in that bill. But I 
would like to see it expand, and not that it just be limited to com- 
puter information but any information breach because of the dump- 
ster diving issue as well. 

Senator Sarbanes. Anyone else who might oppose that? 

Mr. Pratt. Maybe there is just a policy question and that is to 
make sure that if a law like that were to be considered you would 
want to make sure that you did not have a cry wolf event. You 
would want to make sure that there were measurements in place 
to ensure that there was a real breach and that there was a real 
extraction of data because otherwise consumers will be flooded with 
notices because of the requirement of the law and that might be 
ineffective as well. So the key would be that you would need to bal- 
ance the requirements such that breach notices would occur when 
there appears to be a real substantive material reason to have that 
breach notice delivered. I think that is just reasonable in terms of 
how a law like that would operate. 

Ms. Foley. That was built into the law when it was passed. 

Chairman Shelby. Senator Bennett. 

Senator Sarbanes. Thank you, Mr. Chairman. 

Senator Bennett. One of the things we live with in this world 
are pop-ups and advertisements on the Internet all the time. One 
that, at least shows up on my computer a lot, is click here for a 
free credit report. Can we reconcile that with this conversation? 
What do I get if I click that? I have never done it. Frankly, I have 
an irrational fear that doing so would somehow compromise my 
identity and that somebody is after me. So, I never click there for 
a free credit report. What do you get when you do that? 

Ms. Foley. You will be charged $79.95 after a 3-month trial pe- 
riod of a credit monitoring service. 

Senator Bennett. But I would get a free credit report and then 
I would, after 3 months, be able to say, I do not want to spend the 
$79.95? 

Ms. Foley. Correct. But they are also working on the idea that 
most of us do look at these free offers. We go for our free 3 months 
of trial and then we forget to discontinue. 

Senator Bennett. In other words, a free report can be supplied 
pretty quickly if somebody asks for it. Now there is an economic 
reason to say, we will give it to you as a teaser to get you to sign 
up for something else, and I will not discuss whether the some- 
thing else is wise or not wise, whether it is good business or bad 
business, or an improper offering to a customer. I think the cus- 
tomer should make that decision. 

Ms. Foley. Excuse me. Senator Bennett, here is one other prob- 
lem with that free pop-up. We do not know if it is a legitimate offer 
or if it is a scam fraud or it is trying to mine information from you. 

Senator Bennett. I understand that. That is why I do not click 
on them because I do not want to see my credit report because 
everything is going fine. Now, I have been, I will not say a victim 
of identity theft by any means on the scale that Captain Harrison 
has suffered, but I have had some really tough conversations with 
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some lenders that told me that I had filed for bankruptcy and I had 
had default on major property, none of which I had owned, and all 
of the rest of this. And it was not fun to try to get it straightened 
out. They finally figured out there was another Robert Bennett and 
it was not me. 

My daughter has had a fairly serious experience with identity 
theft. Again, nowhere near the level that Captain Harrison has, 
but I am sympathetic with this statute of limitation thing because 
years later she keeps running into problems even after she long 
since had thought she had gotten it all cleaned up. Every once in 
awhile something pops up and, gee, I have to deal with this. It has 
been 3 years since my wallet was stolen. 

Captain Harrison, do you have any idea how they got your mili- 
tary identity card? That is the breach that caused this whole thing. 
It was not dumpster dipping or the stealing of mail. They went to 
a military installation and here is a fellow who has received an 
honorable discharge and years after you have left the military they 
walk away with your identity card. How did they do that? 

Mr. Harrison. He had my name and Social Security number. I 
do not know exactly how he got it because I cannot get access to 
the investigation under the Freedom of Information Act unless I 
get his permission, the imposter, to release that information. But 
it is not difficult to get a name and a Social Security number from 
someone in the military. Those two things are on almost every 
piece of paper I have ever filled out in the military, because your 
Social Security number is also your service number. 

Senator Bennett. The Senate identity card I carry has my Social 
Security number on it, and my driver’s license has my Social Secu- 
rity number on it. When I was running a business and we would 
assign customer numbers, the fellow who ran our IT program came 
to me after a little while and he said, we have to stop using the 
company-generated customer numbers. I said, why, and he said, 
they are far too cumbersome. Let’s go to industry standard and ask 
everybody for their Social Security number, and we did. 

People would open an account with us and we would say, name. 
Social Security number. They would give us the Social Security 
number, and that was the whole database of the company. Whether 
we like it or not, the Social Security number has become the na- 
tional identity number that is in so many databases right now that 
I shudder to think of what it would cost if suddenly everybody had 
to come up with a new number. So yes, your Social Security num- 
ber was your service number. I remember I had to memorize it 
when I was in the Army in the 1950’s. I cannot tell it to you now 
but I can tell you my Social Security number. 

The control in the military is so lax that they would give out to 
somebody a military identity card for somebody who has retired? 
I think we should hold a hearing with the Armed Services and say, 
what are you doing here when you are this lax with something of 
that kind. 

Mr. Harrison. I believe that the person that issued the card was 
in on it. I believe that. I spoke with the Secret Service agent that 
did this and no one else was arrested. But my name and my Social 
Security number was used. They changed my date of birth on the 
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identity card. They changed the color of my eyes, my hair, my 
height, and my weight. 

Senator Bennett. That makes sense. 

Mr. Cunningham. You cannot do that unless 

Senator Bennett. That makes sense if the fellow or young lady 
who delivered the military identity was part of the conspiracy. 
That is heyond the jurisdiction of this Committee, but that might 
be another criminal activity that might be considered. Yes, the fel- 
low who bought the Harley-Davidson went to jail, but the person 
who aided and abetted probably should in some manner be consid- 
ered a co-conspirator and just as liable. 

You talk about family identity theft. Internal to the military or 
whatever, that is a form of family theft. We should take a long look 
at spreading the pain around if somebody aids and abets, and it 
is not just the criminal that goes to jail. 

Thank you very much for the hearing, Mr. Chairman. I think 
this has been very helpful. 

Chairman Shelby. Thank you. Senator Bennett. 

Ms. Foley, out of fairness, you did ask him a question. Everybody 
has had their time, so quickly, what was the question, and quickly 
I hope he will answer it. 

Ms. Foley. We have the one-stop-shop now. Have we resolved 
the problem that the three different repositories want different 
types of information in order to get your credit reports, and that, 
in some cases, I can get it out of two but not the third because each 
one of them has different information and maybe the third one has 
the imposter’s address instead of my address and now the com- 
puter system would not tilt. 

Mr. Pratt. The data exchange has a standard set of data and 
they all agreed on what data elements would have to be provided 
so it could go to each company and each company would use the 
same data elements to pull the file. That is the data exchange part 
of it. There is no doubt each company still has an individual obliga- 
tion to make sure the data matches with a file so they can release 
a file and they can comply with the law and properly identify the 
consumer. 

So, yes, there might be an instance where the data cannot be 
matched properly within an individual company, but the data is 
standard and the data standard is transferred between each of the 
companies. 

Chairman Shelby. Captain Harrison, you are the victim here, 
and a horrible victim. What is your last word to us? 

Mr. Harrison. I guess I will make my last word about the Fair 
Credit Reporting Act. I said this before when I was before the State 
legislature in Connecticut. I think the intent of the Fair Credit 
Reporting Act is very good and I understand it, and I think that 
everybody that put it together understands it. It makes a lot of 
sense. 

Chairman Shelby. It works well in a lot of ways. 

Mr. Harrison. It works well in a lot of ways. I think the problem 
that I have encountered is that a lot of people are not obeying the 
intent. They are only obeying the word. Everything that says may 
might as well say, do not do it. That is why this thing is so dif- 
ficult. People are not understanding the intent. I really think that 
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has to be firmed up. Less of the intent taken out and more of the, 
you have to do this put in it. 

Chairman Shelby. Thank you very much. 

I thank all of you. It has been a long morning. 

The hearing is adjourned. 

[Whereupon, at 1:04 p.m., the hearing was adjourned.] 

[Prepared statements and responses to written questions sup- 
plied for the record follow:] 
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PREPARED STATEMENT OF SENATOR MICHAEL B. ENZI 

Thank you Mr. Chairman for holding this hearing. 

Identity theft is a very serious issue that affects not only individuals, but also our 
economy as a whole. As the fastest growing crime in America, it is not neatly con- 
fined to one State or county. And that is the problem with identity theft. People 
from every corner of the country can and do become victims of this invasive crime. 

Even small States like Wyoming are adversely affected. Although there are only 
493,000 people in Wyoming, we have the same rate of identity theft per capita as 
anywhere else in the country. That is why we have to approach this issue from a 
holistic perspective. We have to look at prevention, enforcement, and assistance to 
victims who are recovering from identity theft. 

Last year, I cosponsored a bill with Senator Cantwell that focused on the recovery 
part of the issue. Our bill would have made it easier for victims to get the informa- 
tion they need to clear their good name. Senator Gramm and I worked with Senator 
Cantwell for months to find a balance between the needs of consumers and the 
needs of small businesses, banks, and other credit agencies. 

Our bill included key provisions that would have allowed victims to work with 
businesses to obtain false records and block false information on credit reports. This 
is critical for somebody who is trying to put his or her life back together after the 
trauma of identity theft. 

I am encouraged by the interest my colleagues have shown here today. There are 
a number of bills out there that I think we need to consider in Congress before this 
crime hurts the hundreds of thousands of working people and families that are 
expected to become victims this year. 

I am confident we can make headway on this issue during the debate on reauthor- 
ization of the Fair Credit Reporting Act and I thank the Chairman for addressing 
this issue today. 


PREPARED STATEMENT OF J. HOWARD BEALES, III 

Director, Bureau of Consumer Protection, U.S. Federal Trade Commission 

June 19, 2003 

Introduction 

Mr. Chairman and Members of the Committee, I am Howard Beales, Director of 
the Bureau of Consumer Protection, Federal Trade Commission (FTC or Commis- 
sion). ^ I appreciate the opportunity to present the Commission’s views on the impact 
of identity theft on consumers and the importance of information security in pre- 
venting identity theft. 

The Federal Trade Commission has a broad mandate to protect consumers, and 
controlling identity theft is an important issue of concern to all consumers. The 
FTC’s primary role in combating identity theft derives from the 1998 Identity Theft 
Assumption and Deterrence Act (Identity Theft Act or Act).^ The Act directed the 
Federal Trade Commission to establish the Federal Government’s central repository 
for identity theft complaints and to provide victim assistance and consumer edu- 
cation. The Commission also works extensively with industry on ways to improve 
victim assistance, including providing direct advice and assistance in cases when in- 
formation has been compromised. The Commission can take enforcement action 
when companies fail to take adequate security precautions to protect consumers’ 
personal information. 


1 The views expressed in this statement represent the views of the Commission. My oral pres- 
entation and responses to questions are my own and do not necessarily represent the views of 
the Commission or any Commissioner. 

2Pub. L. No. 105-318, 112 Stat. 3007 (1998) (codified at 18 U.S.C. §1028). 
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The Federal Trade Commission’s Role in Combating Identity Theft 

The Identity Theft Act strengthened the criminal laws governing identity theft ^ 
and focused on consumers as victimsA Congress also recognized that coordinated ef- 
forts are essential to best serve the needs of identity theft victims because these 
fraud victims often need assistance both from government agencies at the national 
and State or local level and from businesses. As a result, the FTC’s role under the 
Act is primarily one of facilitating information sharing among public and private 
entities.® Specifically, Congress directed the Commission to establish procedures to: 
(1) log the receipt of complaints by victims of identity theft; (2) provide identity theft 
victims with informational materials; and (3) refer complaints to appropriate enti- 
ties, including the major national consumer reporting agencies and law enforcement 
agencies.® To fulfill the Act’s mandate, the Commission has implemented a plan 
that focuses on three principal components: (1) a toll-free telephone hotline; (2) the 
Identity Theft Data Clearinghouse (Clearinghouse), a centralized database used to 
aid law enforcement; and (3) outreach and education to consumers, law enforcement, 
and private industry. 

Assisting Identity Theft Victim 

The most immediate way in which the FTC assists victims is by collecting com- 
plaints and providing advice on recovery through a telephone hotline and a dedi- 
cated website. On November 1, 1999, the Commission began collecting complaints 
from consumers via a toll-free telephone number, 1-877-ID-THEFT (438-4338). 
Every year since has seen an increase in complaints. In 2002, hotline counselors 
added almost 219,000 consumer complaints to the Clearinghouse, up from more 
than 117,000 in 2001. Of the 219,000 reports, almost 162,000 (74 percent) were com- 
plaints from identity theft victims, and almost 57,000 (26 percent) were general in- 
quiries about identity theft. Despite this dramatic growth in reports of identity 
theft, the FTC is cautious in attributing it entirely to a commensurate growth in 
the prevalence of identity theft. The FTC believes that the increase is, at least in 
part, an indication of successful outreach in informing the public of its program and 
the availability of assistance. 

Callers to the hotline receive telephone counseling from specially trained per- 
sonnel who provide general information about identity theft and help guide victims 
through the steps needed to resolve the problems resulting from the misuse of their 
identities. Victims are advised to: (1) Contact each of the three national consumer 
reporting agencies to obtain copies of their credit reports and request that a fraud 
alert be placed on their credit reports; ^ (2) contact each of the creditors or service 
providers where the identity thief has established or accessed an account, to request 
that the account be closed and to dispute any associated charges; and (3) report the 
identity theft to the police and get a police report, which is very helpful in dem- 
onstrating to would-be creditors and debt collectors that the consumers are genuine 
victims of identity theft. 


^ 18 U.S.C. § 1028(a)(7). The statute broadly defines “means of identification” to include “any 
name or number that may be used, alone or in conjunction with any other information, to iden- 
tify a specific individual,” including, among other things, name, address. Social Security number, 
driver’s license number, biometric data, access devices {i.e., credit cards), electronic identification 
number or routing code, and telecommunication identifying information. 

^Because individual consumers’ financial liability is often limited, prior to the passage of the 
Act, financial institutions, rather than individuals, tended to be viewed as the primary victims 
of identity theft. Setting up an assistance process for consumer victims is consistent with one 
of the Act’s stated goals: To recognize the individual victims of identity theft. See S. Rep. No. 
105-274, at 4 (1998). 

®Most identity theft cases are best addressed through criminal prosecution. The FTC itself 
has no direct criminal law enforcement authority. Under its civil law enforcement authority pro- 
vided by Section 5 of the FTC Act, the Commission may, in appropiate cases, bring actions to 
stop practices that involve or facilitate identity theft. See, e.g., FTC v. Assail, Inc., W03 CA 007 
(W.D. Tex. Feb. 4, 2003) (order granting preliminary injunction) (defendants alleged to have deb- 
ited consumers’ bank accounts without authorization for “upsells” related to bogus credit card 
package) and FTC v. Corporate Marketing Solutions, Inc., CIV— 02 1256 PHX RCB (D. Ariz. Feb. 
3, 2003) (final order) (defendants “pretexted” personal information from consumers and engaged 
in unauthorized billing of consumers’ credit cards). In addition, the FTC brought six complaints 
against marketers for purporting to sell international driver’s permits that could be used to fa- 
cilitate identity theft. Press Release, Federal Trade Commission, FTC Targets Sellers Who De- 
ceptively Marketed International Driver’s Permits over the Internet and via Spam (Jan. 16, 
2003) (at http: I j wwiv.ftc.gov ! opa j 2003 1 01 1 idpfinal.htm). 

6 Pub. L. No. 105-318, §5, 112 Stat. 3010 (1998). 

’’These fraud alerts indicate that the consumer is to be contacted before new credit is issued 
in that consumer’s name. See Section II.B.(3)(a) infra for a discussion of the credit reporting 
agencies new “joint fraud alert” initiative. 
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Counselors also advise victims having particular problems about their rights 
under relevant consumer credit laws including the Fair Credit Reporting Act,® the 
Fair Credit Billing Act,® the Truth in Lending Act,^® and the Fair Debt Collection 
Practices ActT^ If the investigation and resolution of the identity theft falls under 
the jurisdiction of another regulatory agency that has a program in place to assist 
consumers, callers also are referred to those agencies. 

The FTC’s identity theft website, located at www.consumer.gov I idtheft, provides 
equivalent service for those who prefer the immediacy of an online interaction. The 
site contains a secure complaint form, which allows victims to enter their identity 
theft information for input into the Clearinghouse. Victims also can read and 
download all of the resources necessary for reclaiming their credit record and good 
name. One resource in particular is the FTC’s tremendously successful consumer 
education booklet. Identity Theft: When Bad Things Happen to Your Good Name. 
The 26-page booklet, now in its fourth edition, comprehensively covers a range of 
topics, including the first steps to take for victims, how to correct credit-related and 
other problems that may result from identity theft, tips for those having trouble get- 
ting a police report taken, and advice on ways to protect personal information. It 
also describes Federal and State resources that are available to victims who may 
be having particular problems as a result of the identity theft. The FTC alone has 
distributed more than 1.2 million copies of the booklet since its release in February 
2000.1® Last year, the FTC released a Spanish language version of the identity theft 
booklet, Robo de Identidad: Algo malo puede pasaHe a su buen nombre. 

Outreach and Education 

The Identity Theft Act also directed the FTC to provide information to consumers 
about identity theft. Recognizing that law enforcement and private industry play an 
important part in the ability of consumers both to minimize their risk and to recover 
from identity theft, the FTC expanded its mission of outreach and education to in- 
clude these sectors. 

Consumers 

The FTC has taken the lead in coordinating with other Government agencies and 
organizations in the development and dissemination of comprehensive consumer 
education materials for victims of identity theft and those concerned with pre- 
venting this crime. The FTC’s extensive consumer and business education campaign 
includes print materials, media mailings, and radio and television interviews. The 
FTC also maintains the identity theft website, which includes the publications and 
links to testimony, reports, press releases, identity theft-related State laws, and 
other resources. 

To increase identity theft awareness for the average consumer, the FTC recently 
developed a new primer on identity theft. Identity Theft: What’s It All About? This 
publication discusses the common methods of identity thieves, how consumers can 
best minimize their risk of being victimized, how to identify the signs of victimiza- 
tion, and the basic first steps for victims. Taken together with the detailed victim 
recovery guide, Identity Theft: When Bad Things Happen to Your Good Name, the 
two publications help to fully educate consumers. 

Law Enforcement 

Because law enforcement at the State and local level can provide significant prac- 
tical assistance to victims, the FTC places a premium on outreach to such agencies. 
In addition to the training described below (see infra Section II.C.), the staff joined 
with North Carolina’s Attorney General Roy Cooper to send letters to every other 
attorney general letting him or her know about the FTC’s identity theft program 
and how each Attorney General could use the resources of the program to better 
assist residents of his or her State. The letter encourages the Attorney General to 
link to the consumer information and complaint form on the FTC’s website and to 
let residents know about the hotline, stresses the importance of the Clearinghouse 
as a central database, and describes all of the educational materials that the attor- 


8 15 U.S.C. § 1681 et seq. 

^Id. §1666. The Fair Credit Billing Act generally applies to “open end” credit accounts, such 
as credit cards, revolving charge accounts, and overdraft checking accounts. It does not cover 
installment contracts, such as loans or extensions of credit that are repaid on a fixed schedule. 

18 /d. § 1601 ci set/. 

11 W. § 1692 et seq. 

1® Other Government agencies, including the Social Security Administration, the SEC, and the 
FDIC also have printed and distributed copies of Identity Theft: When Bad Things Happen to 
Your Good Name. 
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ney general can distribute to residents. North Carolina took the lead in availing 
itself of the Commission’s resources in putting together for its resident victims a 
package of assistance that includes the Identity Theft Affidavit (see Section 
II.B.(3)(a)), links to the FTC website and www.consumer.gov Udtheft. Through this 
initiative, the FTC hopes to make the most efficient use of Federal resources by al- 
lowing States to take advantage of the work the FTC has already accomplished and 
at the same time continuing to expand the centralized database of victim complaints 
and increase its use by law enforcement nationwide. Other outreach initiatives in- 
clude: (1) Participation in a “Roll Call” video produced by the Secret Service, which 
will be sent to thousands of law enforcement departments across the country to in- 
struct officers on identity theft, investigative resources, and assisting victims; and 
(2) redesigning of the FTC’s website to include a section for law enforcement with 
tips on how to help victims, as well as resources for investigations. The FTC will 
launch the new website this summer. 

Industry 

(a) Victim Assistance: Identity theft victims spend significant time and effort 
restoring their good name and financial records. As a result, the FTC devotes sig- 
nificant resources to conducting outreach with the private sector on ways to improve 
victim assistance procedures. One such initiative arose from the burdensome re- 
quirement that victims complete a different fraud affidavit for each different cred- 
itor with whom the identity thief had opened an account. To reduce that burden, 
the FTC worked with industry and consumer advocates to create a standard form 
for victims to use in resolving identity theft debts. From its release in August 2001 
through April 2003, the FTC has distributed more than 293,000 print copies of the 
Identity Theft Affidavit. There have also been more than 356,000 hits to the web 
version. The affidavit is available in both English and Spanish. 

The three major credit reporting agencies (CRA’s) recently launched a new ini- 
tiative, the “joint fraud alert.” After receiving a request from an identity theft victim 
for the placement of a fraud alert on his or her consumer report and for a copy of 
that report, each CRA now shares that request with the other two CRA’s, thereby 
eliminating the requirement that the victim contact each of the three major CRA’s 
separately. 

(h) Information Security Breaches: Additionally, the FTC is working with institu- 
tions that maintain personal information to identify ways to help keep that informa- 
tion safe from identity theft. Last year, the FTC invited representatives from finan- 
cial institutions, credit issuers, universities, and retailers to an informal roundtable 
discussion of how to prevent unauthorized access to personal information in em- 
ployee and customer records. The FTC will soon publish a self-assessment guide to 
make businesses and organizations of all sizes more aware of how they manage per- 
sonal information and to aid them in assessing their security protocols. 

As awareness of the FTC’s role in identity theft has grown, the businesses and 
organizations that have suffered compromises of personal information have begun 
to contact the FTC for assistance. For example, in the cases of TriWest and Ford/ 
Experian,!® in which tens of thousands of consumers’ files were compromised, the 
Commission advised how to notify those individuals and how to protect the data in 
the future. To provide better assistance in these types of cases, the FTC developed 
a kit. Responding to a Theft of Customer or Employee Information, that will be 
posted on the identity theft website in the coming weeks. The kit provides advice 
on which law enforcement agency to contact, depending on the type of compromise, 
business contact information for the three major credit reporting agencies, with 
suggestions for establishing an internal communication protocol, information about 
contacting the FTC for assistance, and a detailed explanation of what information 
individuals need to know. The kit also includes a form letter for notifying the indi- 
viduals whose information was taken. Organizations are encouraged to print and in- 
clude copies of Identity Theft: When Bad Things Happen to Your Good Name with 
the letter to individuals. 

The FTC particularly stresses the importance of notifying individuals as soon as 
possible when information has been taken that may put them at risk for identity 
theft. They can then begin to take steps to limit the potential damage to themselves. 


^^See Identity Theft: When Bad Things Happen to Your Good Name. Hearing Before the Sub- 
committee on Technology, Terrorism, and Government Information of the Senate Judiciary Com- 
mittee, 106th Congress (2000) (statement of Mrs. Maureen Mitchell, Identity Theft Victim). 

i^Adam Clymer, Official Say Troops Risk Identity Theft After Burglary, The New York Times, 
Nov. 6, 2002, Main News, Part 1 (Home Edition), at 12. 

Kathy M. Kristof and John J. Goldman, 3 Charged in Identity Theft Case, Los Angeles 
Times, Nov. 6, 2002, Main News, Part 1 (Home Edition), at 1. 
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Individuals who place a fraud alert promptly have a good chance of preventing, or 
at least reducing, the likelihood that the release of their information will turn into 
actual misuse. The prompt notification also alerts these individuals to review their 
credit reports and to watch for the signs of identity theft. In the event that they 
should become victims, they can quickly take action to clear their records before any 
long-term damage is done. Besides providing Responding to a Theft of Customer or 
Employee Information, FTC staff can provide individual assistance and advice, in- 
cluding a review of consumer information materials for the organization and coordi- 
nation of searches of the Clearinghouse for complaints with the law enforcement 
officer working the case. 

Identity Theft Data Clearinghouse 

The final mandate for the FTC under the Identity Theft Act was to log the com- 
plaints from victims of identity theft and to refer those complaints to appropriate 
entities such as law enforcement agencies. Before launching this complaint system, 
the Commission took a number of steps to ensure that it would meet the needs of 
criminal law enforcement, including meeting with a host of law enforcement and 
regulatory agencies to obtain feedback on what the database should contain. Access 
to the Clearinghouse via the FTC’s secure website became available in July 2000. 
To ensure that the database operates as a national clearinghouse for complaints, the 
FTC has solicited complaints from other sources. For example, in February 2001, 
the Social Security Administration-Office of Inspector General (SSA-OIG) began 
providing the FTC with complaints from its fraud hotline, significantly enriching the 
FTC’s database. 

The Clearinghouse provides a much fuller picture of the nature, prevalence, and 
trends of identity theft than was previously available, The FTC data analysts ag- 
gregate the data to develop statistics about the nature and frequency of identity 
theft. For instance, the Commission publishes charts showing the prevalence of 
identity theft by States and by cities. Law enforcement and policjmiakers at all lev- 
els of government use these reports to better understand the challenges identity 
theft presents. 

Since the inception of the Clearinghouse, 62 Federal agencies and 574 State and 
local agencies have signed up for access to the database. Within those agencies, over 
4,200 individual investigators have the ability to access the system from their desk- 
top computers 24 hours a day, 7 days a week. The Commission actively encourages 
even greater participation. 

One of the goals of the Clearinghouse and the FTC’s identity theft program is to 
provide support for identity theft prosecutions nationwide. Last year, in an effort 
to further expand the use of the Clearinghouse among law enforcement, the FTC, 
in cooperation with the Department of Justice and the U.S. Secret Service, initiated 
a full day identity theft training seminar for State and local law enforcement offi- 
cers. Sessions were held in Washington, DC, Des Moines, Chicago, San Francisco, 
Las Vegas, Dallas, and Phoenix. The Phoenix program was held May 22. More than 
730 officers have attended these seminars, representing more than 170 different 
agencies. Additional training seminars will occur later this year in Seattle, New 
York, and Houston — cities the FTC has identified as having high rates of identity 
theft. Also, the FTC is a member of an identity theft task force in Kansas City and 
is helping coordinate a training seminar there later this summer. 

The FTC staff also helps develop case leads. Now in its second year, the Commis- 
sion runs an identity theft case referral program in coordination with the U.S. 
Secret Service. The Secret Service has assigned a special agent on a full-time basis 
to the Commission to assist with identity theft issues and has provided the services 
of its Criminal Research Specialists. Together, the FTC and Secret Service staff 
develop preliminary investigative reports by examining significant patterns of iden- 
tity theft activity in the database and refining the data through the use of addi- 
tional investigative resources. Thereupon, the staff refer the investigative reports to 


I® Charts that summarized 2002 data from the Clearinghouse can be found at www. consumer, 
gov lidtheft and www.consumer.gov ! sentinel. 

I'^The Commission testified last year in support of S.2541, the Identity Theft Penalty En- 
hancement Act of 2002, which would increase penalties and streamline proof requirements for 
prosecution of many of the most harmful forms of identity theft. See Testimony of Bureau Direc- 
tor J. Howard Beales, III, Senate Judiciary Committee, Subcommittee on Terrorism, Technology, 
and Government Information (July 11, 2002). S.2541 has been reintroduced in the 108th Con- 
gress as S. 153. 

I® The referral program complements the regular use of the database by all law enforcers from 
their desktop computers. 
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appropriate Financial Crimes Task Forces and other law enforcers located through- 
out the country for further investigation and potential prosecution. 

The Federal Trade Commission’s Role in Information Security 

In addition to providing assistance to victims of identity theft, the Commission 
also examines security precautions involving consumers’ personal information to de- 
termine whether law enforcement may be appropriate. If so, the Commission has 
two valuable legal tools to work with: Section 5 of the FTC Act,^® which prohibits 
unfair and deceptive acts or practices, and the Commission’s Gramm-Leach-Bliley 
Safeguards Rule (the Safeguards Rule or the Rule).®® 

Law Enforcement Under Section 5 

One of the mainstays of the Commission’s privacy program is the enforcement of 
promises that companies make to consumers about privacy, including, the pre- 
cautions they take to ensure the security of consumers’ personal information. The 
Commission enforces such promises both online and offline. One area of particular 
concern involves breaches of sensitive information because they put consumers at 
the greatest risk of identity theft and other harms. 

Last August, the Commission announced a settlement with Microsoft regarding 
misleading claims made by the company about the information collected from con- 
sumers through its Passport services — Passport, Passport Wallet, and Kids Pass- 
port. Passport is a service that collects information from consumers and then al- 
lows them to sign in at any participating site using a single name and password. 
Passport Wallet collects and stores consumers’ credit card numbers, and billing and 
shipping addresses, so that consumers do not have to input this information every 
time they make a purchase from a site. Kids Passport was promoted as a way for 
parents to create accounts for their children that limited the information that could 
be collected from them. 

The Commission’s complaint alleged that Microsoft misrepresented the privacy 
afforded by these services, including the extent to which Microsoft kept the informa- 
tion secure. For example, in various online statements, Microsoft said that the Pass- 
port service “achieves a high level of web security by using technologies and systems 
designed to prevent unauthorized access to your personal information.” The Com- 
mission alleged that Microsoft, in fact, failed to employ reasonable and appropriate 
measures to protect the personal information collected in connection with these 
services because it failed to: (1) implement procedures needed to prevent or detect 
unauthorized access; (2) monitor the system for potential vulnerabilities; and (3) 
perform appropriate security audits or investigations. 

The Commission’s order against Microsoft contains strong relief that will provide 
significant protections for consumer information. First, it prohibits any misrepresen- 
tations about the use of and protection for personal information. Second, it requires 
Microsoft to implement a comprehensive information security program similar to the 
program required under the FTC’s Gramm-Leach-Bliley Safeguards Rule, which is 
discussed below. Finally, to provide additional assurances that the information secu- 
rity program complies with the consent order, every 2 years Microsoft must have 
its program certified by an independent professional that it meets or exceeds the 
standards in the order. The provisions of the order will continue for 20 years and 
the Commission is systematically monitoring compliance. 

Microsoft is an important case because the settlement required that the company 
adhere to its security promises even in the absence of a known breach of the system. 
The Commission found even the potential for injury actionable when sensitive infor- 
mation and security promises were involved, and when the potential for injury was 
significant. This determination is an extremely important principle. It is not enough 
to make promises about protecting personal information, and then just hope that 
nothing bad happens or, if it does, that nobody finds out. Fulfilling privacy promises 
requires affirmative steps to ensure that personal information is appropriately pro- 
tected from identity theft and other risks to consumers’ personal information. 

The Microsoft case followed a similar case the Commission settled earlier last 
year against Eli Lilly.®® The Lilly case also involved alleged misrepresentations re- 


19 15 U.S.C. §45. 

®916 CFR Part 314, available online at http: j I ivww.ftc.gov I os ! 2002 1 05 1 67fr36585.pdf . 

®iThe Commission’s final decision and order in the Microsoft case is available at http: I ! 
www.ftc.gov /os/ 2002/ 12/ microsoftdecision.pdf. The Commission’s complaint is available at 
http:/ / www.ftc.gov / os / 2002 / 12 / microsoftcomplaint.pdf. 

®®The Commission’s final decision and order against Eli Lilly is available at http: / /www.ftc. 
gov / os / 2002 / 05 / elilillydo.htm. The complaint is available at http://ww.ftc.gov/os/2002/ 
eliUllycmp.htm. 
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garding the security provided for sensitive consumer information — in this instance, 
consumers’ health information. Like Microsoft, Lilly made claims that it had secu- 
rity measures in place to protect the information collected from consumers on its 
wehsite. As in Microsoft, the Commission charged Lilly with failing to have reason- 
able measures in place to protect the information. 

Specifically, in sending an e-mail to Prozac users who subscribed to a service on 
the site, Lilly put all of the consumers’ e-mail addresses in the “To:” line of the e- 
mail, essentially disclosing to all users the identities of all of the other Prozac users. 
The Commission’s complaint alleged that this happened because Lilly failed, among 
other things, to provide appropriate training and oversight for the employee who 
sent the e-mail and to implement appropriate checks on the process of using sen- 
sitive customer data. The order in the Lilly case prohibits the misrepresentations 
and, as in Microsoft, requires Lilly to implement a comprehensive information secu- 
rity program. 

Just this week, the Commission settled alleged violations of Section 5 in connec- 
tion with statements made by Guess, Inc. concerning the security provided for sen- 
sitive consumer information collected through its website www.guess.com. According 
to the Commission’s complaint, by conducting a “web-based application” attack on 
the Guess, Inc. website, an attacker gained access to a database containing 191,000 
credit card numbers. The complaint alleged that, despite specific claims that it pro- 
vided security for the information collected from consumers through its website. 
Guess did not: (1) employ commonly known, relatively low-cost methods to block 
web-application attacks, which are well-known in the technology industry; (2) adopt 
policies and procedures to identify these and other vulnerabilities; or (3) test its 
website and databases for known application vulnerabilities, which would have 
alerted it that the website and associated databases were at risk of attack. Essen- 
tially, the company allegedly had no system in place to test for known application 
vulnerabilities, or to detect or to block attacks once they occurred. 

In addition, the complaint alleged. Guess misrepresented that the personal infor- 
mation it obtained from consumers through www.guess.com was stored in an 
unreadable, encrypted format at all times; but in fact, after launching the attack, 
the attacker could read the personal information, including credit card numbers, 
stored on www.guess.com in clear, unencrypted text. The order prohibits misrepre- 
sentations about the security and confidentiality of any information collected from 
or about consumers online and, as in Microsoft and Lilly, requires Guess to imple- 
ment a comprehensive information security program. 

This case highlights a crucial but often neglected aspect of information security: 
The security of web-based applications and the databases associated with them. 
Databases frequently house sensitive data such as credit card numbers, and web- 
based applications are often, as with Guess, the “front door” to these databases. It 
is critical that online companies take reasonable steps to secure these aspects of 
their systems, especially when they have made promises about the security they 
provide for consumer information. 

It is important to note that the Commission is not simply sa 3 dng “gotcha” for secu- 
rity breaches. While a breach may indicate a problem with a company’s security, 
breaches can happen even when a company has taken every reasonable precaution. 
In such instances, the breach will not violate the laws the FTC enforces. Instead, 
the Commission recognizes that security is an ongoing process of using reasonable 
and appropriate measures in light of the circumstances. That is the approach the 
Commission took in these cases and in its Gramm-Leach-Bliley Safeguards Rule, 
and the approach it will continue to take. 

GLB Safeguards Rule 

In May 2002, the Commission finalized its Gramm-Leach-Bliley Safeguards Rule, 
which requires that financial institutions under the FTC’s jurisdiction to develop 
and implement appropriate physical, technical, and procedural safeguards to protect 
customer information. The Rule became effective on May 23 of this year, and the 
Commission expects that it will quickly become an important tool to ensure greater 
security for consumers’ sensitive financial information. Whereas Section 5 authority 
derives from misstatements particular companies make about security, the Rule 
requires a wide variety of financial institutions to implement comprehensive protec- 
tions for customer information — many of them for the first time. The Rule could go 
a long way to reduce risks to this information, including identity theft. 

The Safeguards Rule requires financial institutions to develop a written informa- 
tion security plan that describes their program to protect customer information. Due 
to the wide variety of different entities covered, the Rule requires a plan that takes 
into account each entity’s particular circumstances — its size and its complexity, the 
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nature and scope of its activities, and the sensitivity of the customer information 
it handles. 

As part of its plan, each financial institution must: (1) designate one or more em- 
ployees to coordinate the safeguards; (2) identify and assess the risks to customer 
information in each relevant area of the company’s operation, and evaluates the 
effectiveness of the current safeguards for controlling these risks; (3) design and im- 
plement a safeguards program, and regularly monitor and test it; (4) hire the appro- 
priate service providers and contract with them to implement safeguards; and (5) 
evaluate and adjust the program in light of relevant circumstances, including 
changes in the firm’s business arrangements or operations, or the results of testing 
and monitoring of safeguards. The Safeguards Rule requires businesses to consider 
all areas of their operation, but identifies three areas that are particularly impor- 
tant to information security: employee management and training; information sys- 
tems; and management of system failures. 

The Commission has already issued guidance to businesses covered by the Safe- 
guards Rule to help them understand the Rule’s requirements.^® Commission staff 
have met with a variety of trade associations and companies to learn about indus- 
try’s experience in coming into compliance with the Rule, to discuss areas in which 
additional FTC guidance might be appropriate, and to gain a better understanding 
of how the Rule is affecting particular industry segments. Now that the Rule is ef- 
fective, the Commission plans to conduct sweeps to assess compliance within various 
covered industry segments. 

Education and Workshops 

Finally, the Commission recently hosted two workshops focusing on the role that 
technology plays in protecting personal information.®'^ At the first workshop, which 
focused on the technologies available to consumers, we heard that many of these 
technologies have failed because they were too difficult to use; also, consumers did 
not want to pay separately for a “fix” many assumed was already integrated into 
the computers and applications they purchased. Panelists generally agreed that, to 
succeed in the marketplace, these technologies must be easy to use and built into 
the basic hardware and software consumers purchase. 

At the second workshop, which focused on the technologies available to busi- 
nesses, we learned that businesses, like consumers, need technology that is easy to 
use and compatible with their other systems. We also heard that technology should 
be viewed as just one part of an overall information management system that also 
relies heavily on people and the use of appropriate processes and procedures. Unfor- 
tunately, we also heard that too many technologies are sold before undergoing ade- 
quate testing and quality control, frustrating progress in this area. 

On June 18, the Commission hosted a public workshop to examine the costs and 
benefits to consumers and businesses of the collection and use of consumer informa- 
tion. Five CEO’s made presentations about how their companies use and value data. 
Two case studies related to credit transactions and targeting marketing provided 
specific examples.®® In addition, we considered the possible methodologies for fur- 
ther measuring and analyzing the costs and benefits to consumers of these informa- 
tion practices. 

Conclusion 

Identity theft and large scale security breaches place substantial costs on individ- 
uals and on businesses. The Commission, through its education and its enforcement 
capabilities, is committed to reducing these breaches as much as possible. The Com- 
mission will continue its efforts to assist criminal law enforcement with their inves- 
tigations. Prosecuting perpetrators sends the message that identity theft is not cost- 
free. Finally, the Commission knows that as with any crime, identity theft can never 
be completely eradicated. Thus, the Commission’s program to assist victims and 
work with the private sector on ways to facilitate the process for regaining victims’ 
good names will always remain a priority. 


^^Financial Institutions and Customer Data: Complying with the Safeguards Rule, available 
at http: 1 1 www.fte.gov / bcp I coniine / pubs I buspubs I safeguards.htm. 

Additional information about the workshops are available at http:! l www.ftc.gov t bcp l work- 
shops! technology / index, htm. 

Additional information about the workshop is available at http:! j www.ftc.gov j bcp (work- 
shops i infoflows i index.html. 
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PREPARED STATEMENT OF TIMOTHY CADDIGAN 

Special Agent in Charge, Criminal Investigative Division 
U.S. Secret Service 
June 19, 2003 

Mr. Chairman, Senator Sarbanes, and Members of the Committee, thank you for 
inviting me to be part of this hearing today, and the opportunity to address the 
Committee regarding the Secret Service’s efforts to combat identity crime and pro- 
tect our Nation’s financial infrastructure. 

The Secret Service was originally established within the Department of the Treas- 
ury in 1865 to combat the counterfeiting of U.S. currency. Since that time, this 
Agency has been tasked with the investigation of financial crimes, as well as the 
protection of our Nation’s leaders, visiting foreign dignitaries and events of national 
significance. Although, we have moved to the Department of Homeland Security, the 
Secret Service has maintained historic relationships with the Department of the 
Treasury in our ongoing efforts to ensure a secure financial services infrastructure. 

With the passage of new Federal laws in 1982 and 1984, the Secret Service was 
provided primary authority for the investigation of access device fraud, including 
credit card and debit card fraud, and parallel authority with other law enforcement 
agencies in identity crime cases. The explosive growth of these crimes has resulted 
in the evolution of the Secret Service into an agency that is recognized worldwide 
for its expertise in the investigation of all types of financial crimes. Our efforts to 
detect, investigate, and prevent financial crimes are aggressive, innovative, and 
comprehensive. 

The burgeoning use of the Internet and advanced technology, coupled with in- 
creased investment and expansion, has intensified competition within the financial 
sector. With lower costs of information-processing, legitimate companies have found 
it profitable to specialize in data mining, data warehousing, and information broker- 
age. Information collection has become a common byproduct of newly emerging 
e-commerce. Internet purchases, credit card sales, and other forms of electronic 
transactions are being captured, stored, and analyzed by businesses seeking to find 
the best customers for their products. This has led to a new measure of growth with- 
in the direct marketing industry that promotes the buying and selling of personal 
information. In today’s markets, consumers routinely provide personal and financial 
identifiers to companies engaged in business on the Internet. They may not realize 
that the information they provide in credit card applications, loan applications, or 
with merchants they patronize are valuable commodities in this new age of informa- 
tion trading. Consumers may be even less aware of the illegitimate uses to which 
this information can be put. This wealth of available personal information creates 
a target-rich environment for today’s sophisticated criminals, many of whom are or- 
ganized and operate across international borders. But legitimate business can pro- 
vide a first line of defense against identity crime by safeguarding the information 
it collects. Such efforts can significantly limit the opportunities for identity crime, 
even while not eliminating its occurrence altogether. 

Simply stated, identity crime is the theft or the misuse of an individual’s personal 
or financial identifiers in order to gain something of value or to facilitate other 
criminal activity. Types of identity crime include identity theft, credit card fraud, 
bank fraud, check fraud, false identification fraud, and passport/visa fraud. Identity 
crimes are almost always associated with other crimes such as narcotics and weap- 
ons trafficking, organized crime, mail theft and fraud, money laundering, immigra- 
tion fraud, and terrorism. 

According to statistics compiled by the FTC for the year 2002, 22 percent of the 
161,819 victim complaints reported involved more than one type of identity crime. 
The complaints were broken down as follows (note that some complaints involved 
more than one of the listed activities): 

• 42 percent of complaints involved credit card fraud — for example, someone either 
opened up a credit card account in the victim’s name or “took over” their existing 
credit card account; 

• 22 percent of complaints involved the activation of telephone, cellular, or other 
utility service in the victim’s name; 

• 17 percent of complaints involved bank accounts that had been opened in the vic- 
tim’s name, and/or fraudulent checks had been negotiated in the victim’s name; 

• 9 percent of complaints involved employment-related fraud; 

• 8 percent of complaints involved Government documents/benefits fraud; 

• 6 percent of complaints involved consumer loans or mortgages that were obtained 
in the victim’s name; and 
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• 16 percent of complaints involved some type of miscellaneous fraud, such as med- 
ical, bankruptcy, and securities fraud. 

Identity crime is not targeted against any particular demographic; instead, it af- 
fects all types of Americans, regardless of age, gender, nationality, or race. Victims 
include everyone from restaurant workers, telephone repair technicians, and police 
officers, to corporate and Government executives, celebrities, and high-ranking mili- 
tary officers. What victims do have in common is the difficult, time-consuming, and 
the potentially expensive task of repairing the damage that has been done to their 
credit, their savings, and their reputation. According to a report by the General Ac- 
counting Office, the average victim spends over 175 hours attempting to repair the 
damage done by identity criminals. 

In past years, victims of financial crimes such as bank fraud or credit card fraud 
were identified by statute as the person, business, or financial institution that 
incurred a financial loss. All too often the individuals whose credit was ruined 
through identity theft were not even recognized as victims. As a result of the pas- 
sage of the Identity Theft and Assumption Deterrence Act in 1998, this is no longer 
the case. This legislation represented the first comprehensive effort to rewrite the 
Federal criminal code to address the insidious affects of identity theft on private 
citizens. This new law amended Section 1028 of Title 18 of the United States Code 
to provide enhanced investigative authority to combat the growing problem of iden- 
tity theft. These protections included: 

• The establishment of the Federal Trade Commission (FTC) as the central clear- 
inghouse for victims to report incidents of identity theft. This centralization of all 
identity theft cases allows for the identification of systemic weaknesses and pro- 
vides law enforcement with the ability to retrieve investigative data at one central 
location. It further allows the FTC to provide victims with the information and 
the assistance that they need in order to take the steps necessary to correct their 
credit records. 

• The enhancement of asset forfeiture provisions to allow for the repatriation of 
funds to victims. 

• The closing of a significant gap in then-existing statutes. Previously, only the pro- 
duction or possession of false identification documents was unlawful. However, 
with advances in technology such as e-commerce and the Internet, criminals did 
not need actual, physical identification documents to assume an identity. This 
statutory change made it illegal to steal another person’s personal identification 
information with the intent to commit a violation, regardless of actual possession 
of identity documents. 

We believe that the passage of this legislation was the catalyst needed to bring 
together both the Federal and State government resources in a focused and unified 
response to the identity crime problem. Today, law enforcement, regulatory, and 
community assistance organizations have joined forces through a variety of working 
groups, task forces, and information sharing initiatives to assist victims of identity 
crime. 

As you know, Mr. Chairman, the Senate recently passed the Identity Theft Pen- 
alty Enhancement Act of 2002. The intent of this Act is to establish increased pen- 
alties for aggravated identity theft — for example, identity theft committed during 
and in relation to certain specified felonies. This Act, in part, provides for 2 years 
imprisonment for the identity crime, in addition to the punishment associated with 
the related felony and 5 years imprisonment if the related felony is associated with 
terrorism. Additionally, the Act prohibits the imposition of probation and allows for 
consecutive sentences. While this particular legislation cannot be expected to com- 
pletely suppress identity theft, it does recognize the impact identity theft has on 
consumers and the need to punish those engaging in criminal activity for personal 
or financial gain. The Secret Service supports these ideas and believes that they 
represent additional tools that law enforcement can utilize to the fullest extent in 
protecting the American people. 

Identity crime violations are investigated by Federal law enforcement agencies, 
including the Secret Service, the U.S. Postal Inspection Service, the Social Security 
Administration (Office of the Inspector General), and the Federal Bureau of Inves- 
tigation. Schemes to commit identity crime may also involve violations of other stat- 
utes, such as computer crime, mail theft and fraud, wire fraud, or Social Security 
fraud, as well as violations of State law. Because most identity crimes fall under 
the jurisdiction of the Secret Service, we have taken an aggressive stance and con- 
tinue to be a leading agency for the investigation and the prosecution of such crimi- 
nal activity. 

Although financial crimes are often referred to as “white collar” by some, this 
characterization can be misleading. The perpetrators of such crimes are increasingly 
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diverse and today include both domestic and international organized criminal 
groups, street gangs, convicted felons, and terrorists. 

The personal identifiers most often sought by criminals are those generally re- 
quired to obtain goods and services on credit. These are primarily Social Security 
numbers, names, and dates of birth. Identity crimes also involve the theft or misuse 
of an individual’s financial identifiers such as credit card numbers, bank account 
numbers, and personal identification numbers. 

The methods of identity criminals vary. It has been determined that many “low 
tech” identity criminals obtain personal and financial identifiers by going through 
commercial and residential trash, a practice known as “dumpster diving.” The theft 
of both incoming and outgoing mail is a widespread practice employed by both indi- 
viduals and organized groups, along with thefts of wallets and purses. 

With the proliferation of computers and increased use of the Internet, many iden- 
tity criminals have used the information obtained from company databases and 
websites. A case investigated by the Secret Services that illustrates this method in- 
volved an identity criminal accessing public documents to obtain the Social Security 
numbers of military officers. In some cases, the information obtained is in the public 
domain while in others it is proprietary and is obtained by means of a computer 
intrusion. 

The method that may be most difficult to prevent is theft by a collusive employee. 
The Secret Service has discovered that individuals or groups who wish to obtain per- 
sonal or financial identifiers for a large-scale fraud ring will often pay or extort an 
employee who has access to this information through their employment at work- 
places such as a financial institution, medical office, or Government agency. 

In most of the cases that our Agency has investigated involving identity theft, 
criminals have used an individual’s personal identifiers to apply for credit cards or 
consumer loans. Additionally, these identifiers were also used to establish bank ac- 
counts, leading to the laundering of stolen or counterfeit checks or were used in a 
check-kiting scheme. 

The majority of identity crime cases investigated by the Secret Service are initi- 
ated on the local law enforcement level. In most cases, the local police department 
is the first responder to the victims once they become aware that their personal or 
financial identifiers are being used unlawfully. Credit card issuers as well as finan- 
cial institutions will also contact a local Secret Service field office to report possible 
criminal activity. 

The events of September 11, 2001, have altered the priorities and actions of law 
enforcement throughout the world, including the Secret Service. Immediately fol- 
lowing the attacks. Secret Service assisted the FBI with their terrorism investiga- 
tion through the leveraging of our established relationships, especially within the 
financial sector, in an attempt to gather information as expeditiously as possible. 

As part of the new Department of Homeland Security, the Secret Service will con- 
tinue to be involved in a collaborative effort with the intention of analyzing the po- 
tential for identity crime to be used in conjunction with terrorist activities through 
our liaison efforts with the Bureau of Immigration and Customs Enforcement, Oper- 
ation Direct Action, the FinCEN, the Diplomatic Security Service, and the Terrorist 
Financing Operations Section of the FBI. 

The Secret Service continues to attack identity crime by aggressively pursuing our 
core Title 18 investigative violations, including access and telecommunications de- 
vice fraud, financial institution fraud, computer fraud, and counterfeiting. Many of 
these schemes are interconnected and depend upon stealing and misusing the per- 
sonal and financial identifiers of innocent victims. 

Our own investigations have frequently involved the targeting of organized crimi- 
nal groups that are engaged in financial crimes on both a national and international 
scale. Many of these groups are prolific in their use of stolen financial and personal 
identifiers to further their other criminal activity. 

It has been our experience that the criminal groups involved in these types of 
crimes routinely operate in a multi-jurisdictional environment. This has created 
some problems for local law enforcement agencies that generally act as the first re- 
sponders to their criminal activities. By working closely with other Federal, State, 
and local law enforcement, as well as international police agencies, we are able to 
provide a comprehensive network of intelligence sharing, resource sharing, and tech- 
nical expertise that bridges jurisdictional boundaries. This partnership approach to 
law enforcement is exemplified by our financial and electronic crime task forces lo- 
cated throughout the country, pursuant to our Section 1030 computer crime author- 
ity. These task forces primarily target suspects and organized criminal enterprises 
engaged in financial and electronic criminal activity that falls within the investiga- 
tive jurisdiction of the Secret Service. Members of these task forces, who include 
representatives from local and State law enforcement, prosecutors offices, private 



136 


industry and academia, pool their resources and expertise in a collaborative effort 
to detect and prevent electronic crimes. The value of this crime fighting and crime 
prevention model has been recognized by Congress, which has authorized the Secret 
Service (pursuant to the USA PATRIOT Act of 2001) to expand our electronic crime 
task forces to cities and regions across the country. Recently, four new Electronic 
Crimes Task Forces were established in Dallas, Houston, Columbia (SC), and Cleve- 
land bringing the total number of ECTF’s to 13. 

While our task forces do not focus exclusively on identity crime, we recognize that 
stolen identifiers are often a central component of other electronic or financial 
crimes. Consequently, our task forces devote considerable time and resources to the 
issue of identity crime. 

Another important component of the Secret Service’s preventative and investiga- 
tive efforts has been to increase awareness of issues related to financial crime inves- 
tigations in general, and of identity crime specifically, both in the law enforcement 
community and the general public. The Secret Service has tried to educate con- 
sumers and provide training to law enforcement personnel through a variety of part- 
nerships and initiatives. 

For example, criminals increasingly employ technology as a means of communica- 
tion, a tool for theft and extortion, and a repository for incriminating information. 
As a result, the investigation of all types of criminal activity, including identity 
crime, now routinely involves the seizure and analysis of electronic evidence. In fact, 
so critical was the need for basic training in this regard that the Secret Service 
joined forces with the International Association of Chiefs of Police and the National 
Institute for Justice to create the “Best Practices Guide to Searching and Seizing 
Electronic Evidence,” which is designed for the first responder, line officer, and the 
detective alike. This guide assists law enforcement officers in recognizing, pro- 
tecting, seizing, and searching electronic devices in accordance with applicable stat- 
utes and policies. 

We have also worked with these same partners in producing the interactive, com- 
puter-based training program known as “Forward Edge,” which takes the next step 
in training officers to conduct electronic crime investigations. Forward Edge is a 
CD-ROM that incorporates virtual reality features as it presents three different 
investigative scenarios to the trainee. It also provides investigative options and tech- 
nical support to develop the case. Copies of State computer crime laws for each of 
the fifty States, as well as corresponding sample affidavits are also part of the train- 
ing program and are immediately accessible for instant implementation. 

Thus far, we have distributed over 300,000 “Best Practices Guides” to local and 
Federal law enforcement officers and have distributed, free of charge, over 20,000 
Forward Edge training CD’s. 

In April 2001, the Secret Service assisted the FTC in the design of an identity 
theft brochure, containing information to assist victims on how to restore their “good 
name,” as well as how to prevent their information and identities from becoming 
compromised. 

In addition, we have just completed the Identity Crime Video/CD-ROM which 
contains over 50 investigative and victim assistance resources that local and State 
law enforcement officers can use when combating identity crime. This CD-ROM also 
contains a short identity crime video that can be shown to police officers at their 
roll call meetings which discusses why identity crime is important, what other de- 
partments are doing to combat identity crime, and what tools and resources are 
available to officers. The Identity Crime CD-ROM is an interactive resource guide 
that was made in collaboration with the U.S. Postal Inspection Service, the Federal 
Trade Commission, and the International Association of Chiefs of Police. 

Next week, we will be sending an Identity Crime CD-ROM to every law enforce- 
ment agency in the United States. Departments can make as many copies of the 
CD-ROM as they wish and can distribute this resource to their officers to use in 
identity crime investigations. Over 25,000 Identity Crime CD-ROM’s have been pro- 
duced and are being prepared for distribution. 

The Secret Service is also actively involved with a number of Government-spon- 
sored initiatives. At the request of the Attorney General, the Secret Service joined 
an interagency identity theft subcommittee that was established by the Department 
of Justice. This group, which is comprised of Federal, State, and local law enforce- 
ment agencies, regulatory agencies, and professional agencies meets regularly to dis- 
cuss and coordinate investigative and prosecutive strategies, as well as consumer 
education programs. 

In a joint effort with the Department of Justice, the U.S. Postal Inspection Serv- 
ice, the Federal Trade Commission, and the International Association of Chiefs of 
Police, we are hosting Identity Crime Training Seminars for law enforcement 
officers. In the last year and a half, we have held seminars for officers in Chicago, 
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Dallas, Las Vegas, Iowa, Washington, DC, and Phoenix. In the coming months, we 
have training seminars scheduled in New York, Seattle, and Texas. These training 
seminars are focused on providing local and State law enforcement officers with 
tools and resources that they can immediately put into use in their investigations 
of identity crime. Additionally, officers are provided resources that they can pass on 
to members of their community who are victims of identity crime. 

The Secret Service’s Criminal Investigative Division assigned a special agent to 
the Federal Trade Commission (FTC) as a liaison to support all the aspects of their 
program to encourage the use of the Identity Theft Data Clearinghouse as a law 
enforcement tool. The FTC has done an excellent job of providing people with the 
information and assistance they need in order to take the steps necessary to correct 
their credit records, as well as undertaking a variety of “consumer awareness” ini- 
tiatives regarding identity theft. 

It is important to recognize that public education efforts can only go so far in com- 
bating the growth of identity crime. Because Social Security numbers, in conjunction 
with other personal and financial identifiers, are used for such a wide variety of 
record keeping and credit related applications, even a consumer who takes the ap- 
propriate precautions to safeguard such information is not immune from becoming 
a victim. 

The Secret Service recommends that consumers take the following steps to protect 
themselves from identity crime: 

• Maintain a list of all credit card accounts and corresponding phone numbers. 
Keep this list in a place other than your wallet or purse so that immediate notifi- 
cation can occur if any cards are lost or stolen; 

• Avoid carr 3 dng any more credit cards in a wallet or purse than is actually needed; 

• Cancel any accounts that are not in use; 

• Be conscious of when billing statements should be received, and if they are not 
received during that window, contact the sender; 

• Check credit card bills against receipts before pajdng them; 

• Avoid using a date of birth. Social Security number, name, or similar information 
as a password or PIN code, and change passwords at least once a year; 

• Shred or burn preapproved credit card applications, credit card receipts, bills, and 
other financial information that you do not want to save; 

• Secure your incoming and outgoing mail; 

• Establish passwords where possible with credit card companies or financial insti- 
tutions that you have accounts with in order to avoid unauthorized change of 
address, transfer of funds, or orders of additional cards; 

• Order a credit report once a year from each of the three major credit bureaus to 
check for inaccuracies and fraudulent use of accounts; and 

• Avoid providing any personal information over the telephone unless you initiated 
the call, and be aware that individuals and business contacted via the Internet 
may misrepresent themselves. 

Should an individual become the victim of identity theft, the Secret Service rec- 
ommends the following steps: 

• Report the crime to the police immediately and get a copy of the police report; 

• Immediately notify your credit card issuers and request replacement cards with 
new account numbers. Also request that the old account be processed as “account 
closed at consumers’ request” for credit record purposes. Ask that a password be 
used before any inquiries or changes can be made on the new account. Follow up 
the telephone conversation with a letter summarizing your requests; 

• Call the fraud units of the three credit reporting bureaus, and report the theft 
of your credit cards and/or numbers. Ask that your accounts be flagged, and add 
a victim’s statement to your report that requests that they contact you to verify 
future credit applications. Order copies of your credit reports so that you can re- 
view them to make sure no additional fraudulent accounts have been opened in 
your name; 

• File a complaint with the Federal Trade Commission (FTC) by calling 1-877-ID- 
THEFT or writing to them at Consumer Response Center, Federal Trade Commis- 
sion, 600 Pennsylvania Ave., NW, Washington, DC 20580. Complaints can also be 
filed via their website at www.ftc.gov ! ftc ! complaint.htm; and 

• Follow up with the credit bureaus every 3 months for at least a year and order 
new copies of your reports so that you can verify that corrections have been made, 
and to make sure that no new fraudulent accounts have been established. 

Conclusion 

For law enforcement to properly prevent and combat identity crime, steps must 
be taken to ensure that the local. State, and Federal agencies are addressing victim 
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concerns in a consistent manner. All levels of law enforcement should be familiar 
with the resources available to combat identity crime and to assist victims in recti- 
fying damage inflicted on their credit. It is essential that law enforcement recognize 
that identity crimes must be combated on all fronts, from the officer who receives 
a victim’s complaint, to the detective or special agent investigating an organized 
identity crime ring. 

The Secret Service has already launched a number of initiatives aimed at increas- 
ing awareness and providing the training necessary to address these issues, but 
those of us in the law enforcement and consumer protection communities need to 
continue to reach out to an even larger audience. We need to continue to approach 
these investigations with a coordinated effort — this is central to providing a con- 
sistent level of vigilance and addressing investigations that are multi-jurisdictional 
while avoiding duplication of effort. The Secret Service is prepared to assist this 
Committee in protecting and assisting the people of the United States, with respect 
to the prevention, identification, and prosecution of identity criminals. 

Mr. Chairman, that concludes my prepared remarks and I would be happy to 
answer any questions that you or other Members of the Committee may have. 


PREPARED STATEMENT OF MICHAEL D. CUNNINGHAM 

Senior Vice President, Credit and Fraud Operations 
Chase Cardmember Services 

June 19, 2003 

Mr. Chairman, Members of the Committee, my name is Michael D. Cunningham 
and on behalf of J.P. Morgan Chase & Co., we greatly appreciate this opportunity 
to appear before the Committee and share our experience with the issue of identity 
theft. I serve as Senior Vice President for Credit and Fraud Operations for Chase 
Cardmember Services. Protecting our customers from identity theft and fraud is a 
major priority for our entire company. We have devoted the resources necessary to 
play a leading role for the industry by utilizing leading edge technology and hands 
on intervention by over 750 specially trained Chase employees. The personal secu- 
rity and well-being of our customers is a top priority at Chase. 

Below, please find a discussion of the problem, the nuts and bolts of what we at 
Chase do about it, followed by some ideas for changes and improvements for all par- 
ties involved. 

Elements of Identity Theft and Credit Card Fraud 

Identity Theft 

While identity theft and what we call credit card fraud are both pernicious crimes, 
and both constitute fraud, we would like to distinguish the two for policy purposes. 
We place identity theft into two basic categories: 

Fraudulent Applications — Three Pereent of Our Total Fraud Cases 

This involves the unlawful acquisition and the use of another person’s identifying 
information to obtain credit, or the use of that information to create a fictitious 
identity to establish an account. 

In order to commit identity theft by means of fraudulent application, the perpe- 
trator needs to acquire not just a name, address, or credit card number but unique 
identifiers such as the mother’s maiden name. Social Security number, and detailed 
information about a person’s credit history such as the amount of their most recent 
mortgage payment. This is why more than 40 percent of the identity theft cases that 
we see are committed by someone familiar to the victim, frequently a family mem- 
ber or by someone in a position of intimacy or trust. This variety of identity theft 
represents 3 percent of our total fraud cases. 

Account Takeover — One Percent of Our Total Fraud Cases 

This occurs when someone unlawfully uses another person’s identifying informa- 
tion to take ownership of an account. This would typically occur by making an unau- 
thorized change of address followed by a request for a new product such as a card 
or check, or perhaps a PIN number. This variety of identity theft represents less 
than 1 percent of our total fraud cases. 

Non-Identity Theft Fraud — The Other 96 Percent of Our Total Fraud Cases 

This type of fraud constitutes the vast majority of occurrences and falls under four 
basic headings: 



139 


(1) Lost or Stolen Cards: The card is actually in possession of the customer and 
is subsequently lost or stolen. 

(2) Non-Receipt: The card is never received by the customer and is intercepted by 
the perpetrator prior to or during mail delivery. 

(3) Counterfeiting: The card is in possession of an actual customer and a fraudu- 
lent one is subsequently created by a variety of forgery or counterfeiting techniques. 
The customer does not know that the theft has occurred. 

(4) Fraudulent Mail or Telephone Order: The card is in possession of the customer 
and the account number and expiration date is compromised permitting purchases 
by phone, mail, or Internet. 

Who Bears the Liability for Fraud? 

By law, the liability of the consumer who has suffered credit card fraud is limited 
to a maximum of $50 up to the time of notification to the creditor, after which it 
is zero. As a practical matter, with the advent of the Internet and other mediums, 
to promote consumer confidence, MasterCard and Visa simply accept full liability 
for the fraud, as do many individual card issuers. 

The Role of Credit Delivery Systems in Fraud 

Variation in Fraud Rates by Application Channel 

Table 14: Cost of Credit Card Fraud^ 


Type 

Year 2000 
Cost 

(Millions) 

Percent of 
Credit Card 
Fraud 

Percent of Sales 
Volume 

False Applications 

$46.1 

4.5 

0.004 

Other Fraud 

$976.1 

95.5 

0.078 

Total 

$1,013.2 

100.0 

0.082 


During the course of the debate on identity theft and fraud, critics have alleged 
that the process known as “prescreening” or “prescreened offers of credit” somehow 
are major contributors to identity theft and other types of fraud. This is not the 
case. In fact, prescreening is a major underwriting tool integral to safety and sound- 
ness and the lower cost of credit. 

Prescreening Greatly Enhances the Ability of Credit Grantors to 
Accurately Assess Risk and Avoid Losses and Lower Costs 

Prescreened offers have a very low incidence of fraud, and especially so when com- 
pared with other forms of new account generation. At Chase, for 2002, prescreened 
accounts subject to identity theft involved approximately 600 accounts measured 
against 17 million total active accounts. Total fraud cases of all types for 2002 
amounted to about 75,000, including the 600 prescreening cases. Last year, 
prescreening resulted in 1.6 million new accounts out of a total of 4 million new ac- 
counts, or 40 percent of all new accounts. Again, the majority of fraud arising from 
prescreened accounts is committed by someone familiar to the victim. One of our 
competitors. Capital One, a large user of prescreening, recently testified before the 
House Committee that they had similar experience, reporting rates of identity theft 
that are “5 to 15 times lower for credit generated through prescreening than from 
credit generated through other channels (that is, the Internet, in-store “take ones”).” 

Why do prescreened cards result in less identity theft? Prescreened offers of credit 
come from a pool of consumers selected from credit bureau files that have already 
undergone a substantial verification and underwriting process. An identity thief or 
fraudster that is not a family member always chooses the most anonymous method 
of application such as the Internet, or an in-store “take one” application. Choosing 
a prescreened credit card application is the most difficult route by far for the thief 
Prescreened credit card offers do not contain any personal information other than 
name and address, and contain none of the other personal information necessary to 
apply for credit. Identity thieves do not find prescreened offers of credit very useful 
because even if they intercept one, they have to submit a change of address, which 
under Chase’s system (and others that we know of) would trigger an alert and sub- 
sequent analysis. 

The reduced risk of identity theft and other types of fraud has benefits far beyond 
enhancing the personal security of our customers. This enhancement to the under- 


1 The Fair Credit Reporting Act: Efficiency & Opportunity, The Econonic Importance of Fair 
Credit Reauthorization, Information Policy Institute, June 2003, p. 60. 
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writing process lowers the cost of capital and hence the cost of credit and permits 
more credit to be extended. Without prescreening and other techniques for accu- 
rately assessing risk, the costs to credit grantors of raising capital in the secondary 
financial markets would be increased. In order to minimize their costs of capital, 
major credit card issuers and other credit grantors (for example, auto lenders) sell 
a large percentage of their receivables to secondary bond market investors. Many 
issuers sell up to one half of their receivables to investors in the secondary markets. 
The models used to price these securities are largely based on the assessment of 
credit risk. Without the credit enhancements of prescreening (and other national 
credit standards), these models would almost certainly have to be changed to factor 
in additional risks of default, resulting in an increase in costs to the issuers of these 
securities. 

The Role of the Credit Card Industry as the Early Warning System for 
Identity Theft and Fraud — Detection, Prevention, and Resolution 

Industry Practices in General 

The recently released report by the Information Policy Institute contains an excel- 
lent description of industry practices in general: ^ 

Credit card issuers also have authentication procedures in place at many 
stages of the process to limit the ability of criminals to open fraudulent 
credit card accounts. The vast majority of credit card issuers (if not all of 
them) review the application, using a variety of automated tools (Appendix 
F) based upon credit file data to authenticate the identity of the applicant. 

In some cases, if the lender has any degree of uncertainty about the appli- 
cant’s identity, additional documentation (such as a State-issued driver’s 
license or a utility bill) is requested before approval is granted. Even after 
the card has been physically delivered to the applicant, the account is not 
activated until the applicant again verifies his or her identity, usually by 
calling from his or her home phone. 

Issuers undertake these procedures because they are generally liable for 
the cost of fraudulent charges. MasterCard and Visa, for example, have zero 
liability policies that significantly limit the consumer’s responsibility for 
fraudulent charges. Issuers will soon legally be required to authenticate 
identity when opening accounts as well. Given the cost to issuers, it is no 
surprise that losses from fraudulent applications account for significantly 
less than one-hundredth of 1 percent of credit card sales volume and less 
than 5 percent of all credit card fraud. 

The vast majority of credit card issuers further review the application 
using a variety of sophisticated automated tools. These authentication tools 
check the applications for inconsistencies, compare information from the 
application to that in credit files and other national databases, and check 
applications against databases on known fraud. If inconsistencies are de- 
tected, or if the application is identified as being high risk for fraud, the 
tools instruct the issuer to decline the application or perform a thorough 
manual review. 

For example, if the applicant attempts to change the address and the new 
address is different than in these databases, the products indicate the pos- 
sibility that the application is fraudulent and that an identity thief is trying 
to open an account and divert mail away from the victim’s address to avoid 
being detected. These products are very successful, identifying the majority, 
from 60 to 80 percent, of fraudulent applications before the accounts are 
ever opened. The success of these tools also serves as a powerful deterrent 
to potential identity thieves. 

Prevention and Detection at Chase Cardmember Services 

Chase uses a multilayered system of technology, manual analysis, and consumer 
education and assistance to prevent, detect, and resolve all types of fraud. In fact, 
we detect approximately 70 percent of all fraud before the customer even knows it 
has occurred, and we continue to improve every year. The first step in this effort 
is to assess the risk at the application level. Below are some examples of high-risk 
attributes for an application: 

1. Discrepancies between credit bureau and application data. For example, we 
compare. Social Security number, address, name, and date of birth — discrepancies 
cause rerouting to our manual system. 

2. Credit bureau fraud alerts and victims’ statements. 


^Ibid p. 60-61. 
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3. Internal fraud file matches, which entail matches against key personal identi- 
fication data in a file that contains prior victims of identity theft. 

4. Issuer’s Clearinghouse Services (ICS) alerts. The ICS is a shared issuer data- 
base of reported identity theft victims. 

Low-risk applications are automatically approved and monitored for suspicious 
activity by a specialized unit. High-risk applications are subject to manual verifica- 
tion. This includes: 

1. Address validation using a variety of databases. 

2. Direct contact with the true person whose name is being used to apply for 
credit at the location verified for that person. 

3. Authentication using “out of wallet” information such as a person’s most recent 
mortgage payment or similar types of information that typically is not found in a 
person’s wallet and that only the true customer would know. 

4. Request for documentation from the applicant in situations where we are un- 
able to verify the applicant’s identity. 

In addition to the above, we have also developed an address change model that 
utilizes demographic techniques and a file of known fraudulent addresses. Addition- 
ally, we have a security verification methodology for special cases such as when an 
applicant has no home phone number. Utilizing all of these technologies and human 
resources, Chase frequently provides the first notice to the consumer of identity 
theft or fraud. Below is an excerpt from a letter from one of our customers: 

I would like to take this opportunity to praise the performance of (Chase 
employee) . . . Over 6 months ago, Mr. X called me at home because he 
noticed a discrepancy in a credit application that had my name and Social 
Security number. He gave me valuable information that minimized the 
damage to my credit and ultimately led to the arrest of a ring of identity 
thieves. 

Consumer Assistance and Education 

At Chase, we recognize that consumers may need help once they learn of the iden- 
tity theft or fraud. Once a problem is identified. Chase provides consumer education 
and assistance programs, as detailed in the two documents in the appendices to this 
statement. As you can see, we try to be as proactive as possible in dealing with con- 
sumers who are victims of identity theft or fraud. We also actively work with law 
enforcement to try and apprehend the perpetrators. We employ our own investi- 
gators who provide a summary report to law enforcement officials. We then file a 
“Suspicious Activity Report” (SAR) in accordance with Federal regulations, and we 
provide testimony to aid in the prosecution of specific cases. 

Technological Tools To Prevent Identity Theft 

In addition to the detection and prevention methodologies outlined above, we em- 
ploy three important technical tools for prevention of identity theft. First, we use 
Falcon, a so-called neural network technology, which calculates a “fraud score” for 
transactions based on data from a consortium of creditors and customer/merchant 
profiles. Based on this system, we have adopted strategies to approve, decline, or 
refer a transaction for further analysis. Some of the events that may trigger further 
scrutiny of a transaction or an account include new accounts showing cash advance 
and jewelry type transactions or a recent address change accompanied by a high 
dollar cash or mail/phone order activity, just to name two examples. 

Second, we also employ a system that we call “link analysis” that utilizes known 
fraud information to stop subsequent occurrences. This is composed of a caller iden- 
tity database combined with addresses, home and business phone numbers. Social 
Security numbers, and a variety of other relevant information to stop identity theft 
before the perpetrator can assume the identity of an innocent consumer. The third 
technology that we apply is a fraud application-scoring model that relies on patterns 
and other criteria to generate a fraud score for a particular transaction. No one ap- 
proach is a cure-all, but taken together, these applications have enabled a continual 
improvement in our performance. 

Recommendations To Enhance Consumer Protection from 
Identity Theft and Fraud 

In conclusion, despite everything that Chase and others in the industry are doing 
to combat these types of fraud, we have identified some areas that would benefit 
from legislative changes. Please find below an outline of technical changes to the 
law by category that we feel would assist everyone concerned in the fight against 
these crimes. 
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Prevention (Applicable to Financial Institutions) 

• Financial institutions must establish risk-based policies and procedures to verify 
customer identification information. 

• Such policies and procedures used to comply with the requirements imposed 
under Section 326 of the USA PATRIOT Act shall suffice for purposes of account 
opening. 

• Such policies and procedures must include the evaluation of a “fraud alert” ob- 
tained in connection with a consumer report. 

• Such policies and procedures must include the address change verifications, as ap- 
propriate. 

• To the extent not already permitted or authorized, authorize financial institutions 
and associations of hnancial institutions to share information with other financial 
institutions, or associations of financial institutions, regarding individuals, enti- 
ties, organizations, or transactions that may involve identity theft or possible 
identity theft. A financial institution or association that transmits, receives, or 
shares such information for the purposes of identifying and reporting identity 
theft activities shall not be liable to any person under any law, regulation, or 
agreement. Extend the same flexibility and the protections to other businesses 
affected by identity theft, such as retailers. 

• Require disclosure (at same time as “initial” TILA disclosures) to inform con- 
sumers that the hnancial institution may report information to a consumer re- 
porting agency regarding the consumer’s behavior on the account. Disclosure must 
also provide contact information to consumer reporting agencies that operate on 
a nationwide basis. 

• Allow access to Social Security Administration database in order to verify Social 
Security numbers on applications. 

Prevention (Applicable to Consumer Reporting Agencies) 

• Nationwide consumer reporting agencies must establish a method of recording 
and reporting “fraud alert” data. 

• Consumer reporting agencies may truncate an individual’s Social Security number 
on copies of the individual’s credit report provided to the individual so long as the 
Social Security number provided by the individual to obtain the credit report 
matches the Social Security number included in the credit report. 

Other Prevention Related Measures 

• To the extent not already permitted under the FCRA, include fraud prevention 
and identity theft prevention as a permissible purpose to obtain a consumer re- 
port under the FCRA. 

• Ensure continued availability of consumer reports as envisioned under the ECRA. 

• Prohibit display or sale of an individual’s Social Security number to the general 
public. Such prohibition shall not interfere with legitimate business-to-business or 
business-to-government transfers of Social Security numbers, or public record in- 
formation. 

• Prohibit merchants from printing more than the last four digits and the expira- 
tion date of a credit card number on a receipt. 

• Prohibit States from printing Social Security numbers on driver’s licenses and 
other government-issued form of identification. 

Apprehension 

• Have postal service hire additional postal inspectors for purposes of identity theft 
and related investigations. 

• Increase penalties and prosecution for identity theft crimes. 

• Require the Department of Justice to develop a training program for State and 
local law enforcement with respect to identity theft crimes. 

• Require the Department of Justice to develop model definitions, reporting forms, 
and affidavits for use by State and local law enforcement in connection with iden- 
tity theft investigations. 

• Improve civil forfeiture provisions related to identity theft. 

Mitigation 

• Require consumer reporting agencies to block tradelines allegedly the result of 
identity theft if the consumer provides a valid police report regarding the identity 
theft [or other valid indicia of the crime] and provides appropriate identification. 

• Require a business to provide information to a consumer pertaining to an alleged 
identity theft if consumer provides a valid police report regarding the identity 
theft [or other valid indicia of the crime] and provides appropriate identification. 
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This provision must be crafted to ensure it does not create additional opportuni- 
ties for identity theft, and businesses may not be held liable for complying with 
this provision. 

Victims Assistance 

• Develop a simplified standardized document, for example. Uniform Affidavit for 
consumers’ initiation of investigations of claims related to identity theft. 

• Simplify the way consumers can contact their financial institution to make a 
claim of identity theft, that is, call a toll free number on their account statement. 

• Be responsive to identity theft claims in a timely fashion. 

• Require local law enforcement to accept the simplified standardized form and to 
assist the consumer and to produce a police report. 
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APPENDIX A 


Education and Outreach Efforts 

Chase believes that education and outreach about how to protect oneself from becoming the victim of ID 

Theft is also in^itant. In support of this belief, we have taken the following educational efforts regarding 

ID Theft; 

a) Tips on protecting your identity & accounts arc posted on Chase’s Privacy & Security page on 
WWW .chase.com 

b) Periodic notices are included in our statements for customers regarding 
prevention of ID Theft. 

c) Outreach to the Community through Senior Citizens groups and groups like AARP. 

d) Provide advice through toll free numbers to potential victims or persons 
concerned about what to do, including the providing of an ID Theft Kit. 

e) Education is provided to our cnployees about Safeguarding Customer Information. A training 
tape was prepared which became the Industry Standard and was provided by the American 
Bankers Association to all banks. Internal Intranet training about ID Theft prevention and 
Information Safeguarding is mandatory to all those with access to customer information. 

f) Our Code of Ethics includes the rules regarding information use and access. Violators are 
punished - including dismissal and prosecution. 
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iNTRODUCTtON 


At Chase, we understand how upsetting these circumstan<^s are for you and we want to help. First, Chase will 
work with you every step of the way to resolve your situation at Chase. Second, we will assist you as you work 
with the credit bureaus and other key agencies to restore your good name. 

We also recognize that people never really expect this sort of thing to happen to them, and you are probably 
wondering what you should do now. For that reason, we have prepared this Help Kit. 

In the “What To Do Nov/* section of this kit. we provide you with: 

■ The names and contact Information for key agencies, including the major credit bureaus 

■ Other important contacts you may need to make (with investment and credit card companies, the 
Department of Motor Vehicles, etc.) 

■ A checklist to help you keep track of the contacts you’ve made 

• Samples of letters you will likely need to send to the credit bureaus and credit card companies to 
begin the process of disputing charges or accounts 

In addition, we share some information with you about how identity theft can occur, since at this point you may 
not know how someone may have stolen your identity. Unfortunately, there are many ways that identity thieves 
can obtain your personal information and we’ve outlined some of the more common ways in the section “How 
Identity Theft Can Occur,” 

Finally, because you will want to protect yourself as much as you can in the future, we’ve included some tips on 
protecting your personal information in the section titled “What To Do Going Forward.” 

We hope that the information provided in this kit will be helpful to you. And, of course, your Chase 
representative is here to help you through this process. 


2 
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What To Do Now 

Now that you suspect that someone may have stolen your identity, you have already taken the first important 
step of contacting your Chase customs service representative. Chase will work with you every step of the way to 
resolve your situation at Chase. Below we have outlined additional steps that you can take to help restore your 
good name. Please note: You may want to use the Action Taken Form on page 6 to document the steps 
you've taken. 

Chase 

1 . There may be some additional information that your Chase representative needs in order to help you. 

Please review the letter that you received with this kit carefully. If you have any questions, please call the 
number that is included in the letter you received witii tt>is kit 

Key Agencies to Contact 

You will probably want to start by contacting the major credit bureaus, your local police department and the 
Federal Trade Commission. The contact information for each is below, 

1 . Start by contacting the fraud departments of each of the three major credit bureaus. The credit bureaus 
maintain reports that track the credit accounts that have been opened in your name and how you pay your 
bills. You should call first and then follow up in writing (see sample letter on page 7.) 



Exoer^n 

TransUnion 

Call 1-800-525-6285 

Call 1-888-397-3742 

Call 1-800-680-7289 

Write: P.O. Box 740241 

Write: P. 0. Box 949 

Write: Fraud Victim Assistance Division 

Atlanta, Georgia 30374-0241 

Allen. Texas 75013-0949 

P.O. Box 6790 

Fullerton, CA 92634 

www.e<]uifax.com 

www.exDerian.com 

www.tuc.com 


With each bureau you contact, take the following steps: 

a. Request that a “fraud alerf be placed in your file. 

b. Request a victim’s statement asking that creditors call you before opening any new accounts or 
changing your existing accounts. 

c. Ask for copies of your credit reports. Credit bureaus must give you a free copy of your report if your 
report is inaccurate because of fraud. 

■ Review the report carefully to make sure that no additional fraudulent accounts have been 
opened or unauthorized changes made. 

• Check the inquiry section of the report. When ‘'inquiries” appear from companies that opened 
fraudulent accounts, request the “inquiries" be removed from your report. 

■ In a few months, order a new copy of your credit report to verify your corrections and changes. 

■ After reviewing your credit report, you may find tiiat accounts were opened in your name at 
other banks or lenders. Call the company vt^ere the account was opened to report fraudulent 
accounts, then follow up in writing. Include copies (not originals) of documents that support 
your position. A sample dispute tetter can be found on page 7. 

2. File a report with y^ur local police or the police in the community where the identity theft took place. Even if 
the police are unable to catch the thief, having a copy of the police report can help you in dealing with 
creditors. 


3 
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■ Obtain a copy of the Police Report in case ^ur bank, credit card company or others need proof of the 
crime. 

3. Contact the Federal Trade Commission's Identity Theft Hotline at 1-877-tDTHEFT {1-877-438-4338). 
The FTC will put your infoimation into a secure consumer fraud database and may, in appropriate instances, 
share it with other law enforcement agencies. 

Other Important Contacts 


You will probably want to take several additional steps to ensure that your accounts are secure. You should 
review transactions on credit account statements (including credit cards, home equity loans, etc.), bank 
accounts, investment accounts, and telephone. If you suspect Wiat an identity thief may have tampered with any 
of these accounts, key contact information is detailed below. 


TIP: Check vour mail carefully. 

• If you receive statements for accounts you do not have, contact the creditor, An identity thief may have 
opened an account in your name. 

• If you do not receive statements from any of your usual accounts (including credit, banking and investment), 
contact the company immediately. An identity thief may have submitted a change of address in order to 
redirect your statements to a drlferent location. 

• if you do not receive any mail, contact the post office. An identity thief may have falsified a change of 

address to redirect your mail to a different location. 


1 . Credit - Contact creditors, which can include credit card, phone and other utility companies and banks and 
other lenders. 

if an identity thief has tampered with an existing account or opened an account fraudulently: 

• Ask to speak with someone in the company’s security or fraud department and follow up with a letter. 
NOTE; It is important to notify credit card companies In writing as that is the consumer protection 
procedure the law (Fair Credit Billing Act) spells out for resolving errors on credit card billing 
statements. A sample dispute letter can be found on page 8. 

• Close accounts that have been tampered with and open new ones with new Personal Identification 
Numbers (PINs) and passwords. 

If an identity thief has changed the billing address on an existing credit card account; 

• Close the account. 

■ When you open a new account, ask that a password be used before any inquiries or changes be made. 
Avoid using easily available information for a password like a date of birth. Social Security number, etc. 
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2. Bank Accounts - If an identity thief has tampered wtti your savings or choking account or ATM card, close 
the account immediately. Open a new account and ask that a password be used to obtain any information 
(and avoid using easily available information, e.g., ycKir birth date, for a password.) if your checks were 
stolen or misused, either place a stop payment on tfie range of missing checks or close tfie account. Also, 
contact the major check verification companies to request that they notify retailers using their database. 

TeleCheck: 1 -800-71 0-9898 

international Check Services: 1-800-631-9656 

Equifax: 1-800-437-5120 

3. Investments - If an identity thief has tampered with your securities, investments or brokerage account, 
immediately report it to your broker or account manager and to the Securities and Exchange Commission. 

4. Telephone Service - If an identity thief has established a new phone service (including cellular) in your 
name and Is making unauthorized calls, contact your service provider immediately to cancel the account. If 
you have trouble getting fraudulent phone charges removed from your account, contact your state Public 
Utilities Commission for local service or the Federal Communications Commission for long distance service 
provider. 

5. Stolen Mail - If an identity thief has stolen your mail to obtain credit or falsified change of address forms, 
that’s a crime. Report it to your local postal inspector. You can learn how to contact your local postal 
inspection service office by contacting ^ur local post office or by visiting the United States Postal Service 
online at www.usps.gov/websites/depart/inspect. 

6. Employment - If you believe someone is using your Social Security number to apply for a job or to work, 
contact the Social Security Fraud Hotline at 1-800-269-0271. You can also contact the Social Security 
Department at 1-800-772-1213 to verify the accuracy of the earnings reported on your Social Security 
number and to request a copy of your Social Security statement. 

' 7. Driver’s License - If you suspect your name is being used by an identity thief to get a driver’s license or ID 
card, contact your Department of Motor Vehicles. 
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Sample dispute letter - Credit Bureau 


Date 


Your Name 
Your Address 
Your City, State, Zip 

Complaint Department 
Name of Credit Bureau 
Address 
City, State, Zip 

Dear Sir or Madam: 

I am writing to dispute the foilowing information in my fiie. The items I dispute are circled on 
the attached copy of the report I received. (Identity item(s) disputed by name of source, 
such as creditors or tax court, and identify type of item, such as credit account, 
judgment, etc.) 

This item is (inaccurate or incomplete) because (describe what is inaccurate or 
incomplete and why), i am requesting that the item be deleted (or request another 
specific change) to correct the infonnation. 

Enclosed are copies of (use this sentence if applicable and describe any enclosed 
documentation, such as payment records, court documents) supporting my position. 
Please investigate this (these) matterfs,) and (delete or correct) the disputed itemfs) as 
soon as possibie. 

Sincerely, 


Your Name 

Enclosures: (List what you are enclosing) 
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Sample dispute letter - Credit Card Issuers 


Date 


Your Name 
Your Address 
Your City, State, Zip 
Your account number 

Name of Creditor 
Billing Inquiries 
Address 
City, State, Zip 

Dear Sir or Madam: 

I am writing to dispute a billing error in the amount of $ on my account. The 

amount is inaccurate because (describe the problem). I am requesting that the error be 
corrected, that any finance or other charges related to the disputed amount be credited as 
well, and that I receive an accurate statement. 

Enclosed are copies of (use this sentence to describe any enclosed information, such 
as sales slips, payment records) supporting my position. Please investigate this matter 
and correct the billing error as soon as possible. 

Sincerely, 


Your Name 

Enclosures: (List what you are enclosing) 
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How Identity Theft Can Occur 

Despite your best efforts to manage the flow of your personal information or keep it to yourseif, skilled identity 

thieves may use a variety of methods (both low and high tech) to gain access to your data. 

How do identity thieves get your personal information? They: 

• Steal wallets and purses containing your id^tification, credit and bank cards. 

• Steal your mail, including your bank and credit card statements, pre-approved credit offers, telephone calling 
cards and tax information. 

• Complete a “change of address form” to divert your mail to another location. 

• Rummage through your trash, or the trash of businesses, for personal data in a practice known as “dumpster 
diving." 

• Fraudulently obtain your credit report by posing as a landlord, employer or someone else who may have a 
legitimate need for - and a legal right to - the information. 

• Get your business or personal records at work. 

• Find personal information in your home. 

• Use personal information you share on the Internet. 

• Buy your personal information from “inside" sources. For example, an identity thief may pay a company 
employee for infoimation about you that appears on an application for goods, services or credit. 

How do identity thieves use your personal information? They: 

• Call your credit card issuer and, pretending to be you, ask to change the mailing address on your credit card 
account. The imposter then runs up charges on your account. Because your bills are being sent to the new 
address, It may take some time before you realize there's a problem. 

• Open a new credit card account using your name, date of birth and Social Secuniy number. When they use 
the credit card and don’t pay the bills, the delinquent account is reported on your credit report. 

• Establish phone or wireless service in your name. 

• Open a bank account in your name and write bad checks on that account. 

• File for bankruptcy under your name to avoid paying debts they’ve incurred in your name or to avoid eviction. 

• Use counterfeit checks or debit cards and drain your bank account. 

• Buy cars by taking out auto loans in your name. 

In the next section, we describe some steps you can take going forward to protect your personal information 

from identity thieves. 
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What To Do Golno Forward 

Identity theft and account fraud are serious issues. And. at Chase, we believe the more you understand how they 
can occur, the better you’ll be able to take precautions to protect yourself. Chase works hard every day to ward 
off these threats, but even tighter security is possible only wtfi your help. You may be aware of many of the 
steps you can take to stop these crimes before they happen, but some tips may be new to you. For that reason, 
we have outlined some steps you can take to prevent someone from stealing your identity in the future. While 
nothing is foolproof, following the steps outlined below can help to protect you. 

1 . Carry only what you need. The less personal information you have with you the better off you will be if you 
have your purse or wallet stolen. 

2. Don't put outgoing mail in or on your mailbox. Drop it into a secure, official Postal Service collection box. 
Thieves may use your mail to steal your identity. Consider a home shredder for all sensitive documents. 

3. Cancel any credit card accounts that you no longer use. 

4. Don’t pre-print your driver’s license, telephone or Social Security numbers on your checks. 

5. Report lost or stolen checks immediately. Chase will block payment on the check numbers involved. Also, 
review new checks to make sure none have been stolen in transit. 

6. Store cancelled checks — and new checks — in a safe place. 

7. Notify Chase of suspicious phone inquiries such as those asking for account information to “verify a 
statement” or "award a prize." 

8. You should guard your ATM and credit card receipts. Thieves can use them to access your accounts. Never 
throwaway receipts in a public trash can. 

9. Guard your Personal Identification Numbers (PINs) for your ATM and credit cards, and don't write on or keep 
your PINs with your cards. 

10. If you receive financial solicitations that you’re not interested in, tear them up before throwing them away, so 
thieves can't use them to assume your identity. Destroy any other financial documents, such as bank 
statements or invoices, before disposing of them. 

1 1 . Don’t give out financial information such as checking account and credit card numbers — and especially your 
Social Security number — on the phone unless you initiate the call and know the person or organization you’re 
dealing with. Don't give that information to any stranger, even one claiming to be from Chase. 

1 2. If regular bills fail to reach you. call the company to find out why. Someone may have filed a false change-of- 
address notice to divert your information to his or her address. 

1 3. If your bills include suspicious items, don't ignore them. Instead, investigate immediately to head off any 
possible fraud before it occurs. 

14. Periodically contact the major credit reporting companies to review your file and make certain the information 
is correct. For a small fee, you can obtain a copy of your CTedit report at any time. The three major credit 
bureaus are: 

Equifax 1 (800) 685-1 1 1 1 

Experian 1 (800) 682-7654 

TransUnbn 1 (800) 916-8800 

1 5. Chase is committed to ensuring the privacy of your online transactions through the latest security technology. 
That’s why for Internet-based communications we require the use of a browser that supports 128-bit 
encryption for the new, Internet-based product. Chase Online™. 128-bit encryption is the highest level of 
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data protection that is commonly available m today's Internet browsers and is needed to provide the 
approximate level of security we provide for our non-Internet based online banking products, such as Chase 
Online Banking, which uses a dial-up or “virtual private network" approach to transmission security. 

Another online safety feature Is ^r password. Every time you log on to Chase Online™, you are required to 
enter your ID and password. You control both and can change your password at any time. For your safety, 
you should not reveal your password to anyone. For more Infotmation about how are protected vrfien 
using Chase Online™, or for more information about encryption, visit us at Chase.com. 


Together, you and Chase may be able to head off identity theft and account fraud before they ever happen. If 
you would like more information about identity theft, you can visit the Federal Trade Commission’s (FTC) 
consumer website at www.consumer.gov/idteeft. or you can cal) the FTC toll-free at 
(1-877) IDTHEFT (438-4338). 
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Q CHASE 


THE RIGHT RELATIORSHIP IS EVERYTHIHG? 


Authorization to Disclose Information 


i, the undersigned, do give to Chase Manhattan Corporation, The Chase Manhattan Bank, Chase Manhattan 
Bank USA, National Association and any of their direct or indirect subsidiaries {“Chase”) authorization to discuss 
and disclose with third parties the details concerning my daim of fraudulent establishment and/or use of 
account{s) in my name with Chase. This authorization is in addition to any other instruction that I may have 
already provided concerning Chase sharing information about me with any third parties. If there is a conflict 
between this authorization and any previous instructions, this autfiorization will control. 

I understand Chase will respond to requests for information concerning my claim, but not initiate any calls on my 
behalf. By Chase honoring this authorization, I agree to indemnify and hold Chase harmless from any and all 
claims, losses or other costs or expenses which Chase may incur as a result of its reliance on this authorization. 
This action in no way obligates Chase nor makes Chase a party to any action with respect to my claim upon a 
third party. Any actions by Chase will be considered on a best effort basis in assisting me in resolving my daim 
with a third parties). 


Name: 

Address: 

Reference Number:. 

Signature: 

Date: 
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PREPARED STATEMENT OF JOHN M. HARRISON 

Captain, U.S. Army (Retired), Rocky Hill, Connecticut 
June 19, 2003 

Mr. Chairman, Ranking Member Sarbanes, and Members of the Committee, I ap- 
preciate this opportunity to appear before your Committee to share my experiences 
as an identity theft victim. My name is John Harrison. I am 42 years old, a retired 
Army Captain and have resided in Rocky Hill, Connecticut, since my retirement in 
December 1999. Until recently, I have been working as a corrugated salesperson 
since leaving the military. 

Background 

My introduction to the crime of identity theft began on November 5, 2001. On that 
day, I was contacted by a detective from Beaumont, Texas, who was investigating 
a Harley-Davidson motorcycle which had been purchased in my name and Social 
Security number. He tracked me down through my credit report. From that same 
credit report, the detective realized I was a victim of identity theft and he explained 
to me that someone had been using my name and Social Security number to open 
credit accounts and he pointed me in the right direction. 

On that very same day, I reported my identity stolen to the FTC through their 
website. I also contacted all three repositories, ordered my credit reports, initiated 
fraud alerts, and began contacting creditors immediately. Once I received my credit 
reports, I filed a police report with the Army’s Criminal Investigation Division 
which luckily had a branch near Hartford, Connecticut. Just 1 month later, on De- 
cember 12, 2001, Jerry Wayne Phillips was arrested in Burke County, North Caro- 
lina during a traffic stop. He was riding the Harley-Davidson motorcycle the police 
officer in Texas was investigating. Phillips was indicted on Federal charges in 
Texas, pled guilty to one count of identity theft, and is currently serving a 41-month 
sentence at a Federal prison in Minnesota. 

What I have learned since November 5, 2001 is that Phillips gained control of my 
identity on July 27, 2001 when Army officials at Fort Bragg, North Carolina issued 
him an active duty military identity card in my name and Social Security number. 
In a taped interview, Phillips claimed the identity was easy to get. That occurred 
about IV 2 years after my retirement as an Army Captain. 

Damages 

The military identity card combined with my once excellent credit history allowed 
Phillips to go on an unhindered spending spree lasting just 4 months. From July 
to December 2001, Phillips had acquired goods, services, and cash in my name val- 
ued at over $260,000. None of the accounts were opened in my home State of Con- 
necticut. He opened accounts as far south as Florida, as far north as Virginia, and 
as far west as Texas. I have identified more than 60 fraudulent accounts of all 
types: Credit accounts; personal and auto loans; checking and savings accounts; and 
utility accounts. He purchased two trucks through Ford Credit valued at over 
$85,000. A Harley-Davidson motorcycle for $25,000. He rented a house in Virginia 
and purchased a time-share in Hilton Head, South Carolina. 

One of the accounts opened by Phillips was with the Army & Air Force Exchange 
Service (AAFES). He also wrote bad checks in these exchanges. I originally disputed 
this account in March 2002 when AAFES attempted to garnish my military retire- 
ment pay. I was able to stop the garnishment by providing supporting documenta- 
tion to AAFES. They made a second attempt to garnish my retirement in January 
2003 for the same debt. Unfortunately, my letter to AAFES went ignored the second 
time and the garnishment began the end of January. Eventually and with the as- 
sistance of Congressman Larson’s office, the garnishment was stopped in March 
2003 and AAFES refunded the money that had been taken from my retirement pay. 
I have always been somewhat distressed at the military’s involvement in the theft 
of my identity. They issued the fraudulent identity card that allowed Phillips to 
open all these accounts and quite obviously, someone was very negligent in their 
duties. The garnishment greatly added to that distress. 

FCRA Relationship 

While Phillips made creditors, banks, and willing merchants the monetary victims 
of this crime, it has been those same creditors and credit reporting agencies that 
made me a victim. I have struggled with the repositories, creditors, and debt collec- 
tors for 20 straight months now and still have many accounts and debts incorrectly 
reported in my name and Social Security number. My imposter has been in jail for 
19 of those 20 months and no accounts have been opened in my name since his 
incarceration at the end of 2001. I have overwhelming documentation to verify I did 
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not open any of these accounts and I have willingly provided those documents to 
all creditors I have found, as well as the credit bureaus. I have discovered it is more 
cost effective for creditors to write the debt off in the victim’s name than go after 
the real criminal, even after you tell them who and where the real criminal is. 

The credit bureaus hide behind the fact that they are only reporting what credi- 
tors tell them while at the same time, victims are repeatedly sending affidavits, po- 
lice reports, and detailed dispute letters proving the creditors are wrong. That is 
why it takes identity theft victims years instead of months to recover from this 
crime. 

From that first day in November 2001, I have been very aggressive about restor- 
ing the damage done in my name. I have sought out the fraudulent accounts and 
in most cases; I have contacted them before they have contacted me. I have dispute 
all accounts directly with the creditors following that up by disputing the accounts 
through the repositories. I have encountered a great many difficulties. While two 
of the repositories have done what I consider to be a fair job assisting me and re- 
sponding to my disputes, one of them, Equiftix, has failed to meet nearly all the pro- 
visions of the FCRA. It took 11 months and three dispute letters to get a second 
report from Equifax. Further, I found the report they sent to me was not the same 
report they were sending to creditors. Both reports that Equifax has in their system 
still contain as many as fifteen fraudulent accounts. 

I also found that when I disputed accounts to any of the repositories, whether the 
results of the reinvestigation come back with deleted or verified accounts, the ac- 
counts were rarely resolved. Creditors were either not accepting my dispute through 
the repositories or the dispute was not being sent to them. In either event, the ma- 
jority of creditors continue to seek me out directly or through a debt collector. In 
some instances, I have had accounts deleted from one repository only to have it 
show up with another one. I have also encountered creditors that after I have initi- 
ated contact with them to dispute an account, sold the debt to or hired debt collec- 
tors that seek me out at a later time. I have also had difficulties with accounts that 
return months after I have successfully disputed them, like AAFES. Finally, there 
have also been accounts that I have contacted and could find no record of a debt 
in my name and then months later their debt collectors are calling my home or 
showing up on my credit reports. It has been and continues to be a nightmare. 

I have accounted for over 100 bad checks drafted from four different fraudulent 
checking accounts. Phillips wrote bad checks in eight different States and they ac- 
count for nearly $60,000 of the total debt. Unfortunately, the checking accounts 
have created significantly more complications for me than the credit accounts. While 
creditors have just three reporting agencies to choose from, banks and vendors that 
accept checks have a multitude of reporting agencies. Additionally, the majority of 
those reporting agencies, which maintain both positive and negative information on 
consumers, do not provide consumer reports nor are there systems in place to dis- 
pute negative information. I have spent a great deal of time trying to understand 
the checking situation to learn how to properly dispute each bad check that was 
written. My conclusion is, there is no system in place to assist an identity theft vic- 
tim when banking accounts are opened in your name and Social Security number, 
but are completely removed and unrelated to your own banking accounts. This in- 
dustry is well behind the progress that has been made in the credit industry. 

Personal Impact 

There is still a misconception by some that creditors, merchants, banks, and oth- 
ers that sustain monetary losses are the only victims of identity theft. So often when 
speaking to someone about my situation, the comment is made, “At least you are 
not responsible to pay these fraudulent debts.” Somehow, that makes my situation 
seem less tenuous. I have invested over 1,100 hours of my time defending myself 
and working to restore my credit and banking histories. I have filled eight notebooks 
with over 1,500 pages of documentation. I can account for about $1,500 in out of 
pocket expenses directly related to my identity theft. Higher interest rates have cost 
me over $4,000. I have been unknowingly sued by at least one of the creditors. I 
have had my military retirement garnished. I am not creditworthy enough to open 
any new accounts and bad checks reported in my name prevent me from opening 
any deposit accounts with banks. 

It was also during January 2003, that my own creditors began taking adverse 
actions against me as a result of the negative information contained in my credit 
reports. I lost $25,000 in available credit as my creditors closed accounts with zero 
balances or lowered my credit limit to existing balances. I had been with some of 
those creditors over 10 years, but my history of always pa 3 dng on time did not influ- 
ence their decisions. 
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Emotional Impact 

I have always considered myself to be a very strong individual. During the 20 
years that I spent in the military, I was often singled out as someone that worked 
extremely well under stress. The length of time it takes to resolve a stolen identity, 
the frustration in dealing with companies that do not understand the crime or its 
impact and do not take the correct actions, repeatedly having to clear up the same 
accounts, the constant phone calls and letters from debt collectors is enough to 
cause anyone emotional distress. 

In September 2002, 11 months into my struggle, I began to have difficulties with 
anxiety and insomnia and my physician prescribed a mild antidepressant. In Janu- 
ary 2003, the problems with my identity were causing serious distractions for my 
work as a salesperson. I spoke with my supervisor about the problems and began 
weekly therapy in February 2003 through our Employee Assistance Program. I was 
diagnosed with Post Traumatic Stress Disorder. As the doctor put it, my fight or 
flight instincts were stuck on “fight.” Those problems eventually led to my termi- 
nation at the end of April 2003. I was given no notice of the termination nor was 
there a severance offered. I simply had the rug pulled from underneath me. At 
present, I find myself unemployed for the first time since I was 14 years old, being 
treated for what now has become depression, in the worst job market in 9 years, 
and stilling dealing with the same situation that got me here in the first place. 
Sadly, even as I look back over the last 20 months and retrace my steps, I cannot 
identify a single thing I could have done differently that may have prevented the 
situation I am currently in. 

Recommendations 

I have two suggestions that I feel would greatly impact the number of identity 
theft victims. 

First, I believe that we need to focus on those sections of the consumer reports 
titled Personal Identification Information. Currently, if I need to order a copy of my 
report, I have to accurately provide my name. Social Security number, address, date 
of birth, and sometimes several account numbers from my credit report. If I do not 
provide the correct information; I am not allowed to have my credit report. Credi- 
tors, however, are not held to this same standard. Merely by providing a Social 
Security number, they can access the consumer’s credit score and/or credit report. 
Additionally, it is the creditors that control what is reported in the personal infor- 
mation section; not the consumer. I found seventeen different addresses on my var- 
ious credit reports that were used by my imposter. Six different phone numbers. 
Even my date of birth was changed on my credit reports as a result of information 
provided by the creditors that allowed these fraudulent accounts to be opened. I be- 
lieve the consumer is the best source for personal and identifying information; not 
creditors. We should identify essential elements of personal information such as 
name. Social Security number, current address, phone number, sex, current em- 
ployer, and date of birth. A creditor making an inquiry in regards to an application 
should have to correctly provide key and essential identifying information in order 
to complete the inquiry; not just a Social Security number. If incorrect data is pro- 
vided, the creditor should be returned a message from the credit bureau that the 
customer cannot be identified and the inquiry cannot be completed. Had this system 
been in place when my identity was stolen, not a single account could have been 
opened in my name. 

Second, I believe a system should be put in place to annually evaluate the credit 
bureaus. While I am not expert enough on the credit bureaus to identify all criteria 
for such an evaluation, I am certain that credit report accuracy should be one of 
them. I do not want to make unfounded accusations, but it is my belief through com- 
mon sense that credit bureaus do not lose money as a result of identity theft, they 
make money. Over a hundred inquiries have been made to my credit reports as a 
result of fraudulent accounts. These are inquiries the repositories are paid for that 
would not otherwise have been made. Additionally, with the public becoming more 
informed about the seriousness and growth of identity theft, I am certain that sales 
of credit monitoring systems are doing quite well also. Monetarily speaking, there 
is not much incentive for the repositories to be aggressive about preventing identity 
theft or correcting inaccurate reports resulting from identity theft. An evaluation 
system would provide that incentive. Accurate reports are as important to the credi- 
tors that use them as they are to the consumers they belong to. A repository that 
was not doing an adequate job would be penalized through fair competition and my 
feeling is those penalties would invoke positive changes in order to stay competitive. 

The burden of prevention and correction has been placed squarely on the con- 
sumers’ shoulders and yet we have very little control over either. We cannot prevent 
our identities from being bought and sold both legally and illegally by the thou- 
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sands. We cannot prevent the sales manager who is excited by a high FICO score 
from opening an account in our name without verifying the identity. Once the mis- 
takes have been made and the fraudulent accounts opened, the consumer victim is 
caught between the credit bureaus and creditors. It is a life changing experience. 

Again, I want to thank you for your time and this opportunity to share my story 
with your Committee. I hope in some way by sharing my experiences here today, 
we can bring about the needed changes in combating the crime of identity theft. 


PREPARED STATEMENT OF STUART K. PRATT 

President and Chief Executive Officer 
Consumer Data Industry Association 

June 19, 2003 

Chairman Shelby, Senator Sarbanes, and Members of the Committee, thank you 
for this opportunity to appear before the Committee on Banking, Housing, and 
Urban Affairs. For the record, I am Stuart Pratt, President and CEO for the Con- 
sumer Data Industry Association. 

CDIA, as we are commonly known, is an international trade association repre- 
senting approximately 500 consumer information companies that are the Nation’s 
leading institutions in credit and mortgage reporting services, fraud prevention and 
risk management technologies, tenant and employment screening services, check 
fraud prevention and verification products, and collection services. 

We commend you for holding this hearing on the crime of identity fraud and its 
relationship to the Fair Credit Reporting Act (16 U.S.C. Sec. 1681 et seq.). Identity 
fraud is an equal-opportunity crime that can affect any of us. This crime is a par- 
ticularly invasive form of fraud where consumers, consumer reporting agencies, and 
creditors must untangle the snarl of fraudulent accounts and information resulting 
from a criminal’s actions. The task can be frustrating, and, in severe cases, time- 
consuming for all concerned. 

The Committee has asked us to comment on the crime itself and on its relation- 
ship to the FCRA. In this regard, let me focus on three points: 

• The FCRA provides the essential framework of duties for consumer reporting 
agencies and data furnishers and key rights of which all consumers can avail 
themselves, including victims of identity theft. 

• CDIA members have been at the forefront of efforts to understand the nature of 
this crime for years and they have established victim assistance procedures, which 
go beyond the requirements of any law. 

• Consumer education is a mainstay of any successful campaign to reduce the inci- 
dence of identity fraud. Though preliminary, some data indicate that industry and 
governmental efforts to reach consumers is working. 

The FCRA as an Essential Framework of Duties and Rights 

Amended materially in 1996, the FCRA now has a well-balanced set of rights and 
protections for consumers. In particular, the 1996 Amendments focused on reinves- 
tigations and service to consumers. For example, the amendments included codifica- 
tion of time frames for the completion of a consumer’s dispute, which apply to both 
data furnishers and to consumer reporting agencies. The law now “defaults” in favor 
of the consumer where a furnisher of information is unable to respond to a dispute 
by requiring the consumer reporting agency to delete the disputed information at 
the close of the 30-day reinvestigation period. Following is a summary of many key 
provisions of the FCRA that benefit consumers and victims of identity theft. 

Can anyone see a consumer’s report^ 

No. Consumer reports may be provided and used for only the following permis- 
sible purposes: Credit transactions involving the extension of credit or collection of 
an existing account; account reviews (for safety and soundness); emplo 3 Tnent pur- 
poses; insurance underwriting; license eligibility; child support and limited judicial 
inquiries. Users of consumer reports are required to identify themselves, certify the 
purposes for which the report is sought, and certify that it will be used for no other 
purposes. Criminal sanctions result from fraud and misuse. 

Consumers can opt out of prescreened offers of credit with just a toll-free call. The 
FCRA codified the practice of direct mail offers of credit and insurance in the 1996 
Amendments. However, recognizing consumers’ privacy interests, the Act provides 
consumers a single toll-free number for all nationwide credit reporting systems to 
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opt out of all prescreened offers of credit or insurance for either 2 years or perma- 
nently (888-5opt-out or 888-567-8688). 

How is data accuracy ensured? 

Credit reporting agencies are subject to liability unless they follow reasonable pro- 
cedures to assure the maximum possible accuracy of the information regarding the 
consumer. Also, competitive marketplace forces among the consumer reporting agen- 
cies provide a strong institutional incentive to maximize accuracy. 

Consumers always have a right to their file. 

At any time, a consumer may obtain a copy of his or her entire credit file from 
an agency. The report must be provided at a low cost capped by the FCRA (at time 
of enactment, $8.00, currently, based upon CPI indexing, $9.00). The agency must 
include in such a disclosure a summary of the extensive consumer’s rights under 
the FCRA. Consumers also always have a right to be notified of all persons who 
have requested a copy of their files. Note that consumers who are victims of fraud 
and suspect that fraudulent data is on their file are entitled to a free disclosure. 

What happens when a user of a report takes an adverse action based on the report? 

If any adverse action is taken with respect to a consumer based upon a consumer 
report (for example, a denial of credit or employment), the person taking the action 
must notify the consumer and identify the name, address and toll-free telephone 
number of the agency that issued the report. If there is an adverse action, the con- 
sumer is entitled, upon request, to a free consumer report from the agency that 
issued the report. 

What happens when a consumer feels information in a report is inaccurate? 

Any time a consumer disputes the accuracy of any information contained in the 
agency’s file, the agency must within 30 days either reinvestigate the information 
free of charge and note the dispute in the file or delete the information from the 
file. The agency must give the consumer notice of the results of the investigation 
within 5 days of its conclusion. If the agency finds that the information is either 
inaccurate or not verifiable after the reinvestigation, it must delete the information 
from the file. 

Who has enforcement authority over the FCRA? 

The provisions of the FCRA are enforced vigorously by the Federal Trade Com- 
mission, Federal banking regulators and the State attorneys general. Additionally, 
consumers have private rights of action against users, data furnishers, and con- 
sumer reporting agencies for noncompliance with the Act (see below). 

Consumers have private rights of action against users, data furnishers, and con- 
sumer reporting agencies. 

A consumer has a right to sue users, furnishers, and reporting agencies under the 
FCRA for noncompliance with the Act if reinvestigation procedures are violated. 
While a plaintiff can recover actual damages (including noneconomic damages), as 
well as attorneys’ fees, he or she need not prove actual damages because the FCRA 
provides for liquidated damages in cases where there has been a violation. 

CDIA Voluntary Victim Assistance Programs 

While the FCRA provides a robust framework of protections for all consumers, in- 
cluding victims of identity theft, our members have long recognized that the crime 
presented unique problems for victims and to this end we have been actively pur- 
suing progressive voluntary initiatives to ensure that victims of identity theft can 
recover from the crime and get on with their lives. Attached to this testimony is 
an appendix, which provides a short timeline of our efforts and which also includes 
the news release discussing our most recent initiative announced this past April 
2003. Following is a discussion of some of our efforts: 

In March 2000, the CDIA issued a news release (included with this testimony), 
which outlined the credit reporting industry’s six-point victim assistance program. 
Ours was the first industry to step forward and not merely educate its members 
about the problems consumers experienced, but to seek specific changes in business 
practices. These identity fraud victim assistance initiatives were the culmination of 
internal reviews of current processes by senior fraud personnel, interviews with law 
enforcement, victims, and privacy advocates, and input from our Association’s out- 
side counsel on this effort, former Vermont Attorney General, Jerome M. Diamond. 
The industry’s voluntary initiative became effective on January 1, 2001, and while 
our attached news release outlines all six initiatives, let me highlight a few for the 
Committee. 
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Standardizing Security Alerts 

Prior to the CDIA’s initiative, the three credit reporting systems were already vol- 
untarily administering a system of security alerts, which are text messages (often 
accompanied by a code) included in a consumer’s credit report these alerts notify 
lenders and other users of the report of the fact that a consumer has contacted the 
credit reporting system and believes that he or she is a victim of identity fraud. The 
alerts contain, at the consumer’s request, one or two telephone numbers for the 
lender to use in contacting the consumer to verify that he or she is truly seeking 
a new line of credit or other service. 

The CDIA’s initiative sought to improve the effectiveness of these alerts in two 
important ways: 

• The text of the security alerts is now standardized with the goal of ensuring that 
the consumer’s request is honored regardless of which credit reporting system is 
used by a lender; 

• The text message is now preceded by an alphanumeric code that ensures that 
even in a computer-to-computer transmission, the fact that a security alert is part 
of a consumer’s file is easily identified by the lender’s system. 

The security alert is transferred with any consumer credit report, whether it is 
a highly codified version, merely summarized or otherwise formatted for a particular 
lender’s system. 

Standardizing the First Three Steps 

In our interviews with consumer victims, we learned that consistency of experi- 
ence is important. When consumers learn that they are victims of identity fraud, 
they are often advised to order a copy of their file disclosure (that is, credit report) 
from each of the three nationwide credit reporting systems. Under the CDIA initia- 
tive, when consumers call any one of the automated systems to order their file dis- 
closures, they can now have confidence that the same three key steps will be taken: 

• A security alert will be added to the consumer’s file ensuring that if a criminal 
is still active, subsequent lenders will know that the consumer may be a victim 
of identity fraud. 

• The consumer’s file will be opted out of any direct-mail offers of credit or insur- 
ance, thus ensuring that only where the consumer initiates a transaction will the 
consumer’s file be accessed. 

• The consumer’s file will be placed in the mail within three business days of the 
consumer’s request. 

Following Up 

Consumer victims expressed frustration with the difficulty of knowing whether or 
not the crime was “over.” In an effort to help consumer victims stay actively in- 
volved with our members when identity fraud has occurred, CDIA’s credit reporting 
members altered their practices. Specifically, after a consumer’s file has been cor- 
rected and the fraudulent data has been removed through a traditional reinvestiga- 
tion process, our members will then continue to send the identity fraud victim addi- 
tional copies of his or her file for the next 90 days. With each file, the consumer 
will have a toll-free number, which provides access to live personnel and, thus, if 
the consumer spots additional problems with the file, he or she can contact our 
members quickly and have the problem resolved. This 90-day service extends be- 
yond the requirements of the Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq. ) 
and helps mitigate the effects of this longitudinal crime. 

New Victim Assistance Procedures and Police Reports 
Victims of identity fraud want to be believed when they claim that they are vic- 
tims of the crime, and they want their situation addressed quickly. Our members 
looked for a safe and sound process to meet this need and as you can see in our 
attached letter to the Federal Trade Commission, our members have not only com- 
mitted themselves to removing fraudulent data upon request of a victim who has 
a police report, but we have coordinated this effort with the FTC’s Identity Theft 
Clearinghouse. Following are the comments of J. Howard Beales, III, Director of the 
FTC’s Bureau of Consumer Protection, regarding our members’ program. 

Another collaborative effort with tremendous promise is your new police 
report initiative. Through this program, the three agencies have agreed to 
block any credit line when they receive, from the consumer, a copy of the 
police report documenting the identity theft. And, last year the lACP 
passed a resolution encouraging local law enforcement to issue police re- 
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ports to identity theft victims. ^ We are doing our part too, developing a 
training video with lACP to encourage the police to issue the reports. I ap- 
preciate that certain consumer-based initiatives require you to balance ac- 
curacy issues — knowing that the consumer’s report contains all relevant 
credit information, including derogatory reports — against customer service. 
From my perspective, your police report initiative strikes just the right bal- 
ance. You have an assurance of the consumer’s good faith, evidenced 
through the official police report, and the consumer will be untouched by 
the false negative information. I encourage the ACB and its members to 
continue developing programs and systems that ease the burden on identity 
theft victims.”^ 

Acceptance of the FTC Fraud Affidavit 

The FTC undertook a complex and laudable task of tr3dng to simplify an identity 
fraud victim’s paperwork burden by creating a single affidavit for multiple uses. A 
number of our members participated in the work group discussions which led to the 
creation of this new form and all of the CDIA’s nationwide credit reporting system 
members accept this affidavit. 

A Single Call Reaches All Nationwide Consumer Reporting Agencies 

Included with this testimony is our news release wherein we discuss a very new 
initiative that should help victims by reducing the number of phone calls they have 
to make. As of April of this year, consumers can make a call to any of the nation- 
wide consumer reporting agencies and in doing so, their information will be trans- 
ferred to all nationwide agencies, each of which will add a security alert to the vic- 
tim’s file, opt them out of prescreened offers of credit or insurance and issue a file 
disclosure. This is truly a progressive step that makes it easier for a victim to notify 
our members that they have been a victim of identity fraud. 

CDIA and Consumer Education 

Any time a crime is identified, we all want to find the one “silver bullet” which 
will stop it in its tracks. In reality, layers of efforts and, in some cases, years of 
work are necessary to truly reduce the incidents of a particular type of crime. In 
our visits with law enforcement and with consumer groups, it was evident to the 
members of the CDIA that procedural changes are important, but that consumer 
education, focused on prevention and post-victim assistance, was essential. 

A Commitment to Call for Action 

The CDIA committed financial resources and technical expertise to support the 
efforts of Call for Action, a consumer educational organization, which is reaching out 
aggressively to consumers and identity fraud victims. Enclosed with this testimony 
is a practical, easily understood brochure * developed by Call for Action with the as- 
sistance of the CDIA. The brochure has been distributed to: 

• National and State law enforcement agencies; 

• States attorneys general and consumer protection offices; 

• Military barracks and educational institutions; 

• Call for Action regional affiliate offices; and 

• CDIA members. 

Call for Action reports that more than 200,000 identity fraud brochures have been 
distributed and another 100,000 are going to print. Further, the information in the 
brochure is also available on their website and Call for Action reports that they 
have had more than 125,000 visitors view their identity fraud information. The bro- 
chure, produced by Call for Action, is available at www.callforaction.org. 

Call for Action’s efforts also include production of a video news release (VNR). 
Their VNR reached 6.7 million viewers nationwide. The VNR included interviews 
with the FTC and, again, highlighted a message of steps for prevention and for post- 
victim assistance. 

Making sure victims understand their rights 

In addition to the many voluntary steps members of the CDIA have taken on be- 
half of consumer victims, our members must also comply with specific duties under 
the Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.). As important as it is 


1 International Association of Chiefs of Police, Curbing Identity Theft, (November 15, 2000) 
available at www.theiacp.org. 

2 Excerpts from a speech delivered to the members of the Consumer Data Industry Association 
by FTC Director Beales on January 17, 2002. 

*Held in Senate Banking Committee files. 
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for our members to comply with the law, it is equally important that victims of iden- 
tity fraud are fully aware of their rights. To help accomplish this goal, the CDIA 
produced a brochure entitled “The Credit Reporting Dispute Resolution Process.” A 
simple flow chart, which is color coded, ensures consumers understand what must 
be done with their dispute of fraudulent information each step of the way. It has 
been an effective educational tool and it won the National Association of Consumer 
Agency Administrators’ Print Media — Private Sector Category Award in 2000. Each 
year the CDIA sends letters to State consumer protection and State attorneys gen- 
eral offices offering free bulk supplies of this brochure. 

Are the efforts of Government and the private sector paying off? 

There are some trends which are encouraging and which show that our Nation 
is making progress on this issue. The efforts of the FTC, our industry, and others 
to educate consumers about identity fraud appear to be making headway. 

First, our own members report that the majority of consumers who contact our 
credit reporting members’ fraud units are taking preventative steps and are not re- 
porting an actual crime. This is a strong indicator that the message is getting out 
to the consumers to exercise caution and quickly take the right actions to protect 
themselves. 

Regarding victims of the crime, the FTC’s own identity fraud trend data shows 
that 42 percent® of the consumers who contacted the FTC learned about the occur- 
rence of the crime in less than a month. This percentage is fully 10 percentage 
points higher than the statistic cited in the FTC’s previous report. Here too, we see 
that where consumers are educated, they are learning how to spot the crime, and 
take steps to limit the extent of the criminal’s activity. Ultimately, consumer edu- 
cation remains one of the best crime-prevention efforts on which we can continue 
to focus. 

Summary 

In conclusion, we believe that since this crime began being debated publicly, a 
great deal has changed. Our members have voluntarily adjusted their practices to 
better assist victims. The educational efforts of the private sector and the efforts of 
Government are making progress with consumers, both in terms of a improving a 
consumer’s understanding of prevention and post-victim assistance steps that can 
be taken. New laws have been enacted to define this crime and to clarify that con- 
sumers are clear victims. This point may seem to be less significant today. At one 
time 1 victims’ top complaint was merely that law enforcement did not consider 
them to be victims under a crime statute. We continue to applaud the enactment 
of the “Identity Theft and Assumption Deterrence Act of 1998” (Pub. L. 105-318) 
and the more than 30 State laws which our members have actively supported. 

In all of this, while procedures will help victims and reduce application fraud, and 
while consumer educational efforts will continue, we believe that it is critical is that 
Congress ensure that law enforcement has the resources necessary to enforce the 
law. Ultimately, identity fraud is not a consumer protection issue begging for new 
laws. It is a crime prevention issue in need of large-scale, coordinated efforts to in- 
vestigate and prosecute criminals. Law enforcement needs the financial support of 
Congress to get the job done. Everyone who even considers perpetrating identity 
fraud, should also know that they will be pursued, prosecuted, and incarcerated. 
These criminals deserve nothing less. 

Finally, we believe that the FCRA does have the basic framework of rights that 
all consumers need and deserve. Time frames for the completion of the reinvestiga- 
tion of a consumer’s or victim’s dispute are particularly important and this is one 
of the seven provisions of the FCRA that operates as a uniform national standard. 
The benefit of having a national standard is that we can design our systems for as- 
sisting consumers and victims on a nationwide basis and we can be much more suc- 
cessful in encouraging national and local lenders to use our automated systems for 
dispute resolution which allow us to often resolve disputes in less than the FCRA 
standard of 30 days. It would be vastly more difficult to build a nationwide dispute 
resolution network if we had competing State requirements and this would work 
against servicing the needs of identity theft victims, as well. We believe that the 
standard time frames for completion of reinvestigations and all of the uniform 
standards found in Section 624(b) of the FCRA should be made permanent. 

Thank you for the opportunity to appear before this Committee and to share our 
views. I am happy to answer any questions you may have. 


® Federal Trade Commission Report produced by the Identity Theft Clearinghouse entitled 
“Identity Theft Complaint Data, Figures and Trends on Identity Theft,” November 1999 through 
June 2001, page 4. 
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APPENDIX 



Consumer Reporting Agency Responses to Identity Fraud 


• 1993. CDI A, then known as ACB, formed a Fraud and Security Task Force. 

• 1998. Creation of True Name Fraud Task Force led by former Vemwnt Attorney General M. 
Jerome Diamond. The work of the task force included meetings with law enforcement, 
consumer organizations, privacy advocates, legislators and sta^ victims, and others. 

• The capstone of the True Name Fraud Task Force was a series of initiatives announced in 
March 2000. These initiatives meant the consumer reporting industry was ttis first industry 
to step forward and not merely educate its members about the problems consumers 
experienced, but to seek specific changes in business practices. The initiatives are: 

o Advocate the use and improve the efifectiveness of security alerts through the use of 
codes transmitted to creditors. These alerts and codes can help creditors avoid 
opening additional fraudulent accounts. 

o Inqjlement victim-assistance best practices to provide a more uniform experience for 
victims when working with personnel from multiple fraud units, 
o Assist identity theft victims by sending a notice to creditors and other report users 
when the victim does not recognize a recent inquiry on the victim's file, 
o Execute a three-step uniform response for victims who call automated telephone 
systems: automatically adding security alerts to files, opting the victim out of 
prescreened credit offers, and sending a copy of his or her file within three business 
days. 

o Launch new software systems that will monitor the victim's corrected file for three 
months, notify the consumer of any activity, and provide fraud unit contact 
information. 

o Fund, through ACB, the development of a series of consumer education initiatives 
through ACB to help consumers understand how to prevent identity theft and also 
what steps to take if they are victims. 

• 2001 . CDIA announced a police report initiative so that when a police report is provided 
as part of the process of disputing fraudulent data, Equifax, Experian and TransUnion 
will block these disputed items from appearing on subsequent consumer reports regarding 
that individual. 
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o “Another collaborative effort with tremendous promise is your new police report 
initiative...! appreciate that certain consumer-based initiatives require you to 
balance accuracy issues - knowing that the consumer’s report contains all relevant 
credit information, including derogatory reports - against customer service. From 
my perspective, your police report initiative strikes just the right balaiKe.” J. 
Howard Beales, III, Director of the FTC 's Bureau of Consumer Protection, 
before the Consumer Data Industry Association. Jan. 1 7, 2002. 

• 2002. ID Fraud Victim Data Exchange. CDIA and its members committed to start a pilot 
test so that when an ID fraud victim calls any one of the participating credit reporting 
agencies, the victim will be notified that his or her identifying information will be shared 
by the receiving credit reporting agency with the other two participating credit reporting 
agencies and that the following steps will be taken by each recipient of the victim’s 
information; 

o A temporary security alert will be added to the victim’s file. This security alert 
will be transmitted to all subsequent users (e.g., creditors), which request a copy 
of the file for a permissible purpose under the Fair Credit Reporting Act. 
o The victim will be opted out of all non-initiated offers of credit or insurance, 
o The CRA will ensure that a copy of the victim’s file is in tte mail within three 
business days of the victim’s request. 

• Our efforts are paying off. 

o Most calls are prevention related. CDIA members report a majority of 
consumers who contact fraud units are taking preventative steps and are not 
reporting a crime. 

o Victims are learning of the fraud earlier. According to an FTC report in June 
2001, 42% of victims leant about the crime within 30 days or less, a frill 10% less 
than in the prior report. CDIA estimates another 35% lean of the crime within 
one to six months and 7% learn of the crime in six months to a year, 
o Victimization of the elderly is dropping. In2001, the FTC estimated that 6.3% of 
identity fraud victims were over 65, a .5% decrease from 2000. 


About CDIA 


Foimded in 1906, the Consumer Data Industry Association (CDIA), fonnerly known as 
Associated Credit Bureaus, is the international trade association that represents more than 400 
consumer data companies. CDIA members represent the nation’s leadhig institutions in credit 
reporting, mortgage reporting, check verification, fraud prevention, risk management, 
employment reporting, tenant screening and collection services. 

For more information about CDIA, its members, or identity fraud or other issues, please visit us 
at www.cdiaonline.org or contact us at 202-371-0910. 


December 2002 
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Consumer Data Industry Association, the international trade association for the consumer reporting industry, 
announced today a commitment on behalf of the nation's leading credit reporting agencies to voluntarily 
Implement a comprehensive series of initiatives to assist victims of identity theft in a more timely and effective 
manner. 


"While there is no evidence to show that the credit report is a source for identity theft, our industry has always 
taken an active role in assisting consumers who are fraud victims. Our members have taken this responsibility 
seriously, and we're very proud of these initiatives that help consumers who are victims of Identity theft or 
fraud," noted D. Barry Connelly, president of Consumer Data Industry Association. "Designing and 
implementing these initiatives is a significant milestone in the ongoing efforts of our industry to help address 
the problem of identity theft. As long as there are criminals who prey on innocent consumers, we will continue 
to seek even better ways to serve consumers and work with law enforcement and our industry's customers to 
address this threat." 


Connelly outlined the industry's six-point program to improve identity theft victim assistance: 

• Advocate the use and Improve the effectiveness of security alerts through the use of codes transmitted 
to creditors. These alerts and codes can help creditors avoid opening additional fraudulent accounts. 

• Implement victim-assistance best practices to provide a more uniform experience for victims when 
working with personnel from multiple fraud units. 

• Assist Identity theft victims by sending a notice to creditors and other report users when the victim 
does not recognize a recent inquiry on the victim's file. 


• Execute a three-step uniform response for vicUms who call automated telephone systems: 
automatically adding security alerts to files, opting the victim out of prescreened credit offers, and 
sending a copy of his or her file within three business days. 

• Launch new software systems that will monitor the victim's corrected file for three months, notify the 
consumer of any activity, and provide fraud unit contact information. 

• Fund, through CDIA, the development of a series of consumer education initiatives through CDIA to 
help consumers understand how to prevent identity theft and also what steps to take if they are 
victims. 


CDIA's initiatives, to be fully implemented within seven months of this announcement, resulted from a task 
force comprising senior executives from the CDIA Board of Directors and former state Attorney General, M. 
Je/ome Diamond. Diamond interviewed consumer victims and law enforcement officials, made on-sIte visits to 
credit reporting agency fraud units, and obtained input from privacy advocates. His counsel was an Integral 
part of the decision-making process and influenced the final content of the initiatives. 


Connelly said: "Identity theft is a crime that is deeply unsettling for the victims. Our Initiatives will make it 
easier for victims to put their financial lives back together.’ Connelly stressed, though, that the crime extends 
beyond Individuals to creditors and CDIA members and added, "We must all work together in the areas of 
prevention and victim assistance. We supported the enactment of the Identity Theft Assumption and 
Deterrence Act of 1998 and have worked with more than half of the state legislatures on similar laws. We urge 
law enforcement to vigorously investigate and (K-osecute the criminals." 

Consumer Data Industry Association, Inc. is an international trade association representing 500 consumer 
information companies that provide fraud prevention and risk management products, credit and mortgage 
reports, tenant and employment screening services, check fraud and verification services, and collection 
services. 


Source: Consumer Data Industry Association, Inc. 
Web site: www.cdiaonline.oro 
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U.S. Credit Reporting Companies Launch 
New Identity Fraud Initiative 


(n a move to provide consumers with another tool in the fight against Identity fraud, the 
nation's credit reporting companies - Equifax, Experian and TransUnion - have 
simplified the way victims notify them about the crime. Identity fraud victims can make 
one toll-free call to any of the nationwide credit reporting companies and be confident 
that it will result in all three companies taking the same aggressive steps to help protect 
their credit Information. 

"This is the newest in a series of proactive and voluntary initiatives by the credit 
reporting industry to make it easier for victims to communicate with our members and to 
help protect them from additional identity fraud," said Stuart Pratt, President and CEO of 
the Consumer Data Industry Association. "We have been aggressive and we will continue 
to be aggressive in working with our members and with law enforcement to find ways to 
help victims and to encourage vigorous prosecution of ID fraud criminals. With one 
phone call, victims will have, in essence, contacted all of the national credit reporting 
companies. This makes it easier for the victim to report the crime, and it reduces the 
emotional burden, as well. Equally important, with a single call, victims can take the 
proactive step of reducing the chances that they will be further victimized because they 
can be confident that lenders will be sent a security alert notifying them of the 
circumstances of the crime." 


(more) 
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The process is simple. When an identity fraud victim calls any one of the three national credit 
reporting companies, the company contacted will share that information with the other two. Each 
company will follow a standardized three-step process to post a security alert on the credit file, opt 
the victim out of preapproved offers of credit or insurance and mail the victim a copy of his or her 
credit file. 

Here is what the process will look like in more detail once the victim makes a call; 

> The company receiving the initial call will notify the victim of the ID 
fraud initiative and will electronically notify the oUier two credit 
reporting companies of the crime; 

> A fraud alert will be put on the victim's credit report at all three 
nationwide credit reporting companies within 24 hours; 

> The victim will be opted out of all preapproved offers of credit and 
insurance for two years; 

> The victim’s request for a copy of his or her credit report will be 
handled in no more than three business days. Each of the three 
national credit reporting companies will work with the victim to verify 
the information in their respective reports and to delete any fraudulent 
data. If the victim files a police report, the process Is even quicker. 

CDIA’s national credit reporting company members will voluntarily 
expedite services for the victim by immediately deleting fraudulent 
data without the usual reinvestigation procedure; and, 

> The fraud alert will be displayed by each national credit reporting 
agency to all lenders or other users that access ^e reports in the 
future. Once notified that the consumer has been a victim of ID fraud, 
the lender can then avoid opening a fraudulent account. 

CDIA members formed the first industry task force to address the issue in 1997. Since then, several 
programs have been adopted by the Industry to specifically target the crime of ID fraud. Some of 
the more significant initiatives are: 

> Adopting a six-point program that includes a standardized three-step 
program for responding to victims, ensuring victims’ flies remain 
corrected after a reinvestigation by providing additional free 
disclosures of files during the next 90 days, assisting consumers in 
contacting their creditors regarding the crime and implementing 
procedures that help creditors better identify fraud alerts on credit 
reports; 


(more) 
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> Without additional reinvestigation procedures, deleting fraudulent 
items from appearing on the credit report when the consumer submits 
a police report notifying the credit reporting agency of crime; and, 

> Supporting educational efforts of groups like Call For Action and 
others as they provide consumer's and victims with materials on 
identity fraud prevention. 


"We will continue to work with victims to ease their burdens, to partner with lenders to prevent 
additional identity fraud from occurring, and to support law enforcement's need for additional 
resources to properly investigate the crime and prosecute criminals," Pratt said. He noted that 
efforts appear to be working. One reflection of that is that the Federal Trade Commission’s recent 
reports from their ID Theft Clearinghouse 

(1.877.ID.THEFT or 1.877.438.4338) indicate that more victims than ever are identitying the crime in 
a short period of time, which reduces the extent of the harm. He added that the national credit 
reporting companies report that more calls are now fielded from consumers wanting information on 
how to protect themselves from ID fraud than from those who are victims of the crime. 

The credit reporting companies' fraud assistance departments can be contacted at the following 
numbers. A single call to just one of these numbers is all that a victim needs to make: 

Equifax 1.800.525.6285 

Experlan 1.888.397.3742 

TransUnion 1.800.680.7289 

Founded in 1906, the Consumer Data Industry Association is the international trade association 
that represents more than 400 consumer data companies. CDIA members include the nation's 
leading institutions In credit reporting, mortgage reporting, check verification, fraud prevention, 
risk management, employment reporting, tenant screening and collection services. 
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PREPARED STATEMENT OF LINDA FOLEY 

Executive Director, Identity Theft Resource Center 
June 19, 2003 

Members of the Committee, thank you for the opportunity to provide hoth written 
and oral testimony for your Committee today and for your interest in the topic of 
identity theft. 

The Identity Theft Resource Center (ITRC) is passionate about combating identity 
theft, empowering consumers and victims, assisting law enforcement, reducing busi- 
ness loss due to this crime, and helping victims. We are honored by your invitation 
and will continue to make our opinions available upon request to your representa- 
tives over the next few months as you grapple with this complex crime and the 
FCRA sunsetting. 

About ITRC 

The Identity Theft Resource Center’s (ITRC) mission is to research, analyze, and 
distribute information about the growing crime of identity theft. It serves as a re- 
source and advisory center for consumers, victims, law enforcement, legislators, 
businesses, media, and governmental agencies. 

In late 1999, Linda Foley founded this San Diego-based nonprofit program after 
becoming a victim of identity theft. In her case, the perpetrator was her employer. 
ITRC’s work with thousands of victims (by e-mail and by phone), credit granters, 
representatives from the CRA’s, law enforcement officers, governmental agencies, 
and business has taught us much. 

Jay Foley, ITRC Co-Executive Director and Co-Writer of this testimony has spent 
hundreds of hours speaking with victims while assisting in their recovery, listening 
as they discuss their revictimization by “a system that doesn’t care, understand, or 
listen.” As one of the few groups that deal with a victim throughout recovery proc- 
ess, we have a unique perspective on the crime. Our information is not just moment 
of discovery statistics. Our information comes at the cost of minutes, hours, days, 
weeks, months, and years of a victim’s life. 

Through our testimony we will introduce you to some of the victims who have 
helped us to understand the changes that must be made in the areas of prevention 
and recovery. We hope their stories illuminate the issues as clearly for you as they 
have for us. To protect their privacy, they will be referred to as initials only. 

The ITRC has worked for a number of years to make changes in laws, policies, 
business practices, and trends to combat this crime. As a result, we have composed 
a list of recommendations that we feel will make a difference both in crime preven- 
tion (keeping the information from the hands of criminals and the issuance of credit) 
and in victim recovery. 

Our Testimony 

ITRC has been asked to address the following points: 

• The Crime: Who are these criminals and what is identity theft? 

• The Victim: What are some of the crimes we hear about? 

• Crime Expansion: crime trends, numbers, stats, anecdotes and articles? 

• Victim Recovery: What steps must victims take? 

• Recommendations about areas that need change? 

• Provide your perspective as to the value of State involvement. 

• Our opinion of the FCRA battle. 

Identity Theft 

The Crime 

There are four recognized main categories of identity theft: 

• In financial identity theft the imposter uses personal identif 3 dng information, pri- 
marily the Social Security number, to establish new credit lines in the name of 
the victim. This person may apply for telephone service, credit cards, loans, buy 
merchandise, or lease cars and apartments. Subcategories of this crime include 
credit and checking account fraud. 

• Criminal identity theft occurs when a criminal gives another person’s personal 
identif 3 dng information in place of his or her own to law enforcement. In relation 
to your Committee and focus, this type of crime might occur in relationship to 
checking account fraud. Many States do prosecute on bad checks or on opening 
accounts fraudulently. 

Case history: One of our recent cases involved a woman who lives in Pittsburgh. 
Her imposter had several warrants in Kentucky for opening a fraudulent checking 
account and writing bad checks on it. The victim was 8 months pregnant at the time 
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of the crime, restricted by her doctor to bed (in Pittsburgh), and clearly incapable 
of committing this crime. The bank finally cleared her but forgot to tell the DA to 
cancel the warrant. She has incurred legal expenses, as well as other expenses in 
clearing her name and rectifying the inaccurate records from various databases. 

• Identity cloning is the third category. This imposter uses the victim’s information 
to establish a new life. He or she actually lives and works as you. This crime may 
also involve financial and criminal identity theft as well. Types of people who may 
try this fraud include undocumented immigrants, wanted felons, people who do 
not want to be tracked (that is, getting out of paying child support or escaping 
from an abusive situation), and those who wish to leave behind a poor work and 
financial history and “start over.” 

• Commercial identity theft is similar to financial identity theft and cloning except 
the victim in this type of case is a commercial entity. Criminals open checking 
and credit accounts as that company, order product, and may even try to conduct 
business as that entity. Unfortunately, this has yet to be explored topic and good 
answers for these victims are few. 

The Victims 

Identity theft is a dual crime and no one is immune, from birth to beyond death. 
Who are these victims? It could be you, unknown at this very moment. Let us intro- 
duce you to some of our clients/victims who have turned to us for assistance. Some 
of these cases are cut/paste of e-mails we have received from victims. We present 
them to you so that you can see what we work with on a daily basis. 

Case 1: Child Identity Theft. Victim owes about $65,000, $4,700 in child arrears 
and has 3 DUI warrants in his name. One problem. Jose is only 6 years old now 
and those arrears are to himself. The perpetrator is his father, now divorced from 
Jose’s mother, an illegal immigrant, and subject to deportation when found. 

Case 2: Identity Theft of the Deceased. Perhaps one of the most poignant stories 
we have heard {New Jersey Star Ledger reported it) is the theft of a man’s identity 
who died in the World Trade Center attack on September 11, 2001. His widow was 
notified about 10 months after the event to discuss her husband’s recent auto acci- 
dent. She went through hours of turmoil only to discover that an illegal immigrant 
had created a false driver’s license and was living and working as her deceased hus- 
band. Unfortunately, this is only one of more than several dozen cases that we have 
worked on involving the deceased. In some cases, the imposter has purchased the 
information, in others the perp is a family member or even a caregiver. Some may 
ask what is the harm in using the Social Security number of the deceased. Not only 
can this affect the estate but the survivors still dealing with the grief of losing a 
loved one. In one other case, a mother has had to fight collectors trying to collect 
money from accounts opened in her daughter’s name, a daughter who died several 
years ago. Each new call opens up the wound again. 

Case 3: Information Breach, Workplace Identity Theft. T’s identity was stolen by 
her doctor’s receptionist. She found out when applying for her first home loan, her 
dream home. Months later, after clearing her records, spending her own time to re- 
search how her thief got ber information and used it, and seeing another family 
move into her home, she was able to convince authorities to prosecute her offender. 
The result — the thief is now living in a halfway house, driving the car she bought 
with T’s identity, and working for another doctor as a staff member. T was finally 
able to buy a house almost 2 years later, at a higher purchase cost, with a higher 
interest rate due to the multiple accounts that had been opened in her name after 
the placement of a fraud alert. 

Case 4: Victim Recovery Issue. Victim owns her own business. For the past 3 
years, she has been in a fight with her bank. They repeatedly open new accounts 
and grant access to her existing accounts, even generating dual credit cards sending 
them to the imposters as well as herself. At one point, she went to the local branch 
of her bank to once again put to rights the transfer of her account information. With 
multiple pieces of identification in her possession she was devastated by the bank 
officers who would not acknowledge her right to discuss the accounts in question 
or accept her identifying documents including passport, driver’s license, utility bills, 
business license, and Social Security card. To date she still has problems with her 
bank and her accounts. She is currently talking to an attorney and plans to sue the 
multiple companies who continue to torment her and refuse to correct their errors. 
She believes that lawsuits are her only option left. 

Case 5: Financial identity Theft Turns into Criminal Case. Two nights ago, I was 
arrested as part of a 4-year ongoing theft of my identity. The arrest was over bad 
checks written in Lincoln, Nebraska near where I reside. 

The issue, other than the arrest and all that goes with it, is the fact that JPM 
was able to open fraudulent accounts because the Nebraska DMV had issued her 
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a license with her picture and my information. I do not know what documentation 
she provided them, but we clearly do not have the same physical features. This 
should have sent up a red flag to the DMV. As a result, JPM illegally used my iden- 
tity to spend almost $40,000, with new credit cards and with fraudulent checks. 

I am doing the best I can to be compensated for the money spent on bail, loss 
of work time, personal stress, which all occurred while I was finishing my under- 
graduate degree and throughout my master’s degree. Needless to say, this has inter- 
fered with my performance in school because of the time it takes to free myself as 
a citizen and as a consumer. The arrest was the last straw, and I have been told 
that the statute of limitations to sue the woman who stole my identity has expired. 
I am looking for help. 

Case 6: Social Security Number Used as Driver’s License Number. Victim had car 
broken into just prior to a move from Hawaii to Delaware. A file with all identity 
and information was stolen in Hawaii including her driver’s license which used her 
Social Security number as the identity number. Since then a fraudulent cell phone 
account was setup with VoiceStream generating a bill for $10,000.00. The victim has 
made some payments during the course of the account dispute due to the bull 3 dng 
action of the collectors threatening to attach to possessions. Because of that 
VoiceStream refuses to acknowledge the account is fraudulent. 

Case 7: Security Breach. Victim was referred to ITRC by the FBI VictimAVitness 
Coordinator. The victim is a 72-year-old retired Air Force Major. His dentist told 
him his identity was stolen. The dentist had befriended a man who saw the victim’s 
dental records. This man then copied and used all of victim’s info. The dentist found 
out when he saw files out of place. This befriended man/handyman was the only 
person who had access. The imposter purchased a condo, a BMW, and used the vic- 
tims HMO for medical services. The victim’s HMO paid for this, tjpon arrest it was 
discovered that the imposter had a prior record of fraud. The imposter is now in 
jail on nonrelated charges. 

Case 8: Cloning. Victim lives in San Diego on disability. The imposter is living 
and working in Illinois. Fraud is impacting her disability. IRS and SSA have been 
contacted. Victim is fearful of losing housing and being unable to cover living ex- 
penses due to the lengthy time of recovering her good name and clearing the 
records. 

Case 9: Workplace Identity Theft. The victim recently found out of the identity 
theft. In 1999, a co-worker stole her credit card. The victim went through all the 
necessary procedures with her credit card company to remove the charges including 
filing a police report. In January 2002, the victim applied for a loan with a small 
finance company. The victim was told her Social Security number had already been 
used to apply for a loan with this company. The victim retrieved the application and 
found it was used back in 1999 by the same lady who stole her credit card. The 
victim had never been contacted by this company. The company’s reply: We denied 
the application. Unfortunately in doing so, they did not indicate that it was denial 
due to fraud but due to not enough income. 

I did go to the company with this, I even spoke with the Vice President in South 
Carolina and she was useless. I still have not received a copy of my credit report 
so I am not sure if she has not done any real damage or not. I am sure she used 
my Social Security number and I am not sure how else I can file a report if the 
police are not helpful. Thank you again. 

Case 10: Extreme Case. Victim’s identity stolen by co-worker 10 years ago. She 
knows who the perp is and he has been questioned but released by police (refusal 
to take action due to “extenuating family circumstances”). In the meantime, the vic- 
tim has been unable to stop the perp from opening credit and checking accounts, 
fraudulently applying for welfare, etc. She has had to change her Social Security 
number, driver’s license number, and name, essentially recreating herself in order 
to separate and protect her from the actions of the perp. 

Case 11: Reoccurrence. My wife was a victim of identity theft in 1999. After many 
letters, a police report, and an affidavit of forgery, we thought ever 3 dhing was set- 
tling. We were reassured that the loan and credit that was taken out in our name 
was removed from our reports and that our credit restored. We asked several times 
for correspondence that this was taken care of but no one returned a letter. As time 
passed and we received no bills, we forgot about it. That is until we received an 
Equifax on June 2, 2002 showing it still on the report. I tried to contact the office 
that I communicated with before but no one would return my call. The date reported 
was after we had notified them of the dispute. Are they in violation of the FCRA? 
Please advise or direct. 

Case 12: Family Identity Theft. Victim’s relative used victim’s identity to clear out 
victim’s bank accounts. This relative has victim’s Social Security number and stole 
checks. Victim has filed police report and is in contact with the managers at her 
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bank. LEA is not investing a great deal of time on case, usually claiming that this 
is a family dispute. Family identity theft is one of the most difficult crimes we work 
on, in part, due to lack of police action and, in part, due to the emotional impact 
of this crime. How does one turn one’s own mother in to the police? Unfortunately, 
we receive about 3-5 of these types of cases each week. 

Case 13: Domestic Abuse, Harassment. The victim was divorced in 1987, she now 
lives in Florida. The ex-husband is operating here in San Diego. Due to the actions 
of her ex, the victim is having IRS, SSA problems and is dealing with 3 accounts 
under her name. Unfortunately, identity theft is the perfect tool to harass another 
person and to perpetuate domestic abuse after a divorce or separation. 

Case 14: Stolen Wallet. I live in Texas. On June 2, 2002, my wallet was stolen 
in New York City. On June 6, 2002, a woman began using my identity from the 
wallet including driver’s license. Social Security number from a medical insurance 
card, place of emplo 3 Tnent, and stolen cards to establish instant credit at 9 different 
stores in 3 different States. I have placed a credit alert fraud with the three credit 
reporting agencies but there has already been theft totaling in excess of $16,000. 
I am now having difficulty getting anyone to follow through with a report and also 
changing my drivers license number. Because the theft occurred out of my home 
State, I have to follow up on the phone and not getting much response or help. 

Case 15: Military Spouse. I have had the frustrating and humiliating experience 
of somebody taking my maiden name and Social Security number in order to open 
numerous fraudulent utility accounts leaving my credit reports a mess. I am also 
a military wife who is required to show my Social Security number on my identity 
card, which is used for everything. 

Case 16: Enable Credit Granting Behavior. I was a victim of credit fraud/identity 
theft beginning in November 2001, and continuing until approximately April 2002. 
All of the many fraudulent credit applications using my name and identifying infor- 
mation were done in the Los Angeles area. Somehow, my personal identifying infor- 
mation (Social Security number, name, birth date, etc.) were obtained and used to 
apply for instant store credit at Radio Shack, Gateway Computers, and approxi- 
mately a dozen other merchants. Additionally, my personal credit card was “taken 
over” by these criminals. By calling Visa and posing as me, they changed my billing 
address, and claimed that they had lost the credit card. They then received my new 
Visa card in the mail at the fraudulent address. They applied for many credit cards 
under my name and were even successful at getting a few, then charging the cards 
up to the maximum very quickly. 

Case 17: Mail Theft by an Acquaintance. I just found out on June 14, 2002, that 
I am the victim of identity theft by my housekeeper/babysitter. Since she had access 
to my mail it was easy. She opened the first account in April 2001. She has charged 
over $10,000 that I am aware of and I have jewelry, etc. missing from my home. 
This is so recent that I do not even know what I am up against yet, what I do know 
is that this has hurt my 11-year-old daughter very badly. My daughter sang in the 
housekeeper’s wedding last May, I wonder now if the wedding was all charged to 
me! I would be happy to talk to anyone about this. I live in a small town of 12,000 
people, right now I know 4 people, personally, that this has happened to including 
the President of one of the banks here in town. Something must be done!! She is 
having trouble getting creditors off her back. 

Case 18: Domestic Abuse, Insurance Fraud. My ex-husband and his employer used 
my Social Security number to file medical claims on my health insurance. My ex 
has not been covered on my insurance since 1999, and I have changed employers 
and insurance carriers since that time. However, claims for February 2002 through 
May 2002 have been filed on my current insurance. He has obtained the information 
without my knowledge. I found out about the claims after receiving Explanation of 
Benefit forms from my insurance provider. The claims have been denied, so the 
insurance provider states that they are doing their job. The insurer will not file a 
report with the police. 

Case 19: IRS Complications. I have had my identity stolen. Someone has gotten 
hold of my Social Security number and, from that, cause me to have false credit bu- 
reau claims and a warning from the IRS that I had underreported my income. 
Creditors have harassed me and required me to go to extraordinary lengths to prove 
that I could not have incurred the debt in question. The IRS has required extensive 
documentation as well. Right now the activity has settled down, but anytime the 
next shoe could fall. Even though there is a certain person I suspect of engaging 
in this identity theft, law enforcement authorities turn a deaf ear. I really do not 
blame them, it is not a high-priority crime to them. To me, it is a major theft and 
closely akin to rape. This whole situation has been aided by the use of computers 
and the overuse of the Social Security number. I understand that the original law 
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establishing the issuance of Social Security numbers stated that that number should 
only be used for Social Security, but indeed, that has not been the case. 

Case 20: Victim Frustration — Complex Case. I became a victim of identity theft 
in March 2001. I found out when the person who had my Social Security number 
tried to open a credit card with a bank that I already had a card with. The woman 
was not able to give my correct birthday. They contacted me but they gave me a 
hard time saying that it was my daughter. They suggested that I contact the credit 
agencies about a fraud alert. That is when I found out that the person had many 
credit cards and a cell phone and they even bought a computer from Dell. Since I 
found out early, I was able to stop almost ever 3 dhing before it was way out of hand. 
I filed a report with the Dallas police department and talk to a detective all the 
time. Only to find out they would do nothing. They had the address the cards and 
computer was sent to but they would not go there. They even had another address 
where the person used a credit card in my name to buy a pizza. I found a lot of 
information on the Internet and started writing letters and sending them certified 
return receipt. I also made a file that I have with everything I did and all the cop- 
ies. It took many months to clear everything up and I still have the fraud alert on 
my report for 7 years. This is a crime that is too easy for someone to do and they 
get away with it because our laws are too easy and the officers are not trained on 
this type of crime. I feel I am luckier than most because I found out early and was 
able to clear up the damage within a year. 

While you know my story, that only tells part of the picture. What I discovered 
disturbed me greatly: 

• Fraud alerts only help a little. Most places do not even honor them. So, I am not 
sure they help very much. 

• After I put the fraud alert on, they still opened a few more credit cards. All of 
the accounts they opened were done on the Internet. 

• I found that the credit card companies did not care much, they just closed the 
accounts. But before they will close the accounts, you have to prove to them it 
was not you who opened the account. 

• They also made you wait on the phone a long time and you are transferred to 
many people before you found one that could help you. Most of the people I talked 
with acted like they were not educated enough on the subject. 

• They treat you like it was your fault and most of them need more training on 
this issue. 

• The police are no help at all. 

• The credit agencies take forever to remove the fraud accounts from your file. 

• The victim spends hundreds of hours writing letters and making phone calls try- 
ing to remove the damage that the thief caused while they were free to go to the 
next victim. 

• Laws should help the victims, but you are alone when it comes to identify theft. 
Victim Impact; The Good, The Bad, and The Ugly 

While the victims are not usually held liable for the bills accumulated by the im- 
posters, many do suffer significant financial and emotional harm from this crime. 
According to studies done by the Privacy Rights Clearinghouse (PRO/CALPIRG in 
2000 and Federal Trade Commission (FTC), the average victim spends about 175 
hours and $1,100 in out-of-pocket expenses. These expenses include notarizing, post- 
age, telephone, travel, photocopying, costs involved in getting police reports and fin- 
gerprints, and resource materials. ITRC is in the process of completing an updated 
study. We believe that the numbers will be significantly higher due to the com- 
plexity of the crimes committed. 

In many situations this does not cover time lost from work, loss in productivity 
while working or loss of personal or vacation time. Some victims never truly regain 
their financial health and find credit issuers and even employers are reluctant to 
deal with someone with “baggage.” 

To have someone use your good name, a reputation in which you have invested 
much time, energy, and money, is a deeply felt violation — financially, emotionally, 
and on that has the power to affect your decisions, relationships, and financial/ 
criminal history from that point forward in your life. 

The emotional impact of identity theft can be extremely traumatic and prolonged 
due to the extensive amount of time it can take to clear one’s name. Some victims 
can be dealing with the crime for 3-7 years after the moment of discovery. 

Victims face many challenges in cleaning up the mess left by the thief. In the best 
case scenario: 

• Law enforcement takes a report and provides a copy to the victim. 

• The victim discovers the case early enough to prevent it from being sold to a col- 
lection agency. 
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• The initial contact with the creditor is not misleading nor ignored. 

• The creditor freezes the account based on telephone contact and closes it com- 
pletely when presented with a police report identifying the account as fraudulent. 

• The victim is provided with information that when provided to law enforcement 
makes the case and supports the arrest and prosecution of the thief. 

• The victim is given a letter of clearance and the entries and inquiries are removed 
from the credit report. 

• The creditor works with the victim and the police to complete the case. 

In the bad version, the victim: 

• Victim fights with police to get a report taken. 

• Has to deal with the creditor and one or more collection agencies. 

• The creditor’s staff is unhelpful. They provide inaccurate information. 

• Creditors refuse to make account and transaction information available to the vic- 
tim claiming privacy concerns of the accountholder/criminal. The victim is bur- 
dened with proving innocence without the benefit of knowing where the charges 
were made, how the account was opened, dates of purchases, etc. 

• Too often victims are told to have the police request this information but when 
requests are made by law enforcement they are denied access as well without a 
stack of paperwork at best. 

• They make statements to the victim that the account is cleared up but do not take 
the actions necessary to close or clear the account. 

• Accounts are resold after the victim has provided proof of the fraudulent nature 
of the account. 

• Victims are told that they are still responsible for the account when a family 
member did it fraudulently. 

• Accounts are not removed from the credit report by the creditor when proven to 
be fraudulent. 

• Victim is mislead to believe that the CRA will respond to their requests to have 
information removed or corrected on the credit report. The CRA passes the fact 
that a dispute over the validity of an account exists to the creditor but does not 
present any of the evidence submitted by the victim. 

In the ugly version, the victim: 

• Faces all of the problems from the bad version plus. 

• The victim is sued by the creditor without the victim’s knowledge and a judgment 
rendered against the accountholder — the victim. (The imposter is served.) 

• The victim is arrested for the crimes of the thief. 

• Property is seized by court order leaving the victim to attempt to have the court 
reverse the order. 

• Homeless people and minors face many unique problems getting copies of their 
credit reports. 

• Despite all efforts, the victim is unable to stop the thief from using his/her Social 
Security number, name and other information. In these cases the ultimate solu- 
tion is to change one’s identifying information — name. Social Security number, 
driver’s license number, etc. The problem: This solution creates more problems 
then it solves. You are now a person without a credit, work, college, or life history. 
You are nothing more than a blank slate. 

Identity Theft’s Negative Economic Ripple Effect 

In terms of economic impact, a recent Florida Grand Jury report stated: “The av- 
erage loss to the financial industry is approximately $17,000 per compromised iden- 
tity. For criminals, identity theft is an attractive crime. An identity thief can net 
$17,000 per victim, and they can easily exploit numerous victims at one time, with 
relatively little risk of harm. By comparison, the average bank robbery nets $3,500 
and the criminal faces greater risk of personal harm and exposure to a more serious 
prison sanction if convicted.” (reprinted at www.idtheftcenter.org under Speeches.) 

The Privacy Rights Clearinghouse 2000 Report found the average economic loss 
per victim to be $18,000, ranging from $250 to in excess of $200,000 (footnote 1). 
While the FTC study, so far, shows a different number, their numbers are based 
primarily on moment of discovery. In identity theft, it sometimes takes months be- 
fore the total damage can be assessed. 

Using the number of $17,000 per victim and the estimate of 700,000 victims, the 
economic loss could total $11.9 billion to merchants, credit issuers, and the financial 
industry in 1 year alone. 

ITRC would like to further add that that $11.9 billion loss is just the beginning. 
You also have to add the cost of law enforcement and criminal justice time, costs 
to victims (including expensive attorney time) and secondary economic losses to mer- 
chants when merchandise “bought” by imposters is resold resulting in a lessening 
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of customer trade. Finally, there is the cost of investigating and prosecuting sec- 
ondary illegal activities (drug trafficking, etc.) funded with the money made by im- 
posters or information brokers who sell the documents used by some imposters and 
those wishing to identity clone. 

Identity Theft Trends 

There are clear indications that identity theft is not only a crime that is com- 
mitted by your garden-variety type of thief but is also used by organized crime 
groups. ITRC’s new study will help to show the complexity of the crimes that are 
committed, the impact financially and emotionally and to help us track this crime 
even more effectively. 

Dumpster diving: Digging through trash is not glamorous but can be very profit- 
able especially when that dumpster sits behind a mortgage broker, dentist’s office, 
rental office, insurance company, or even a market or governmental agency. The pa- 
pers there are a wealth of information including account number. Social Security 
number, names, unlisted phone numbers, and even mother’s maiden name. The 
value of these dumpsters is that the thief doesn’t leave with one document but with 
dozens at a time. 

Scams: Creative writing teachers would be proud with the types of both telephone 
and Internet scripts that have been written to separate you from your information. 
Some, including that apparently come from governmental agencies or from credit 
providers even seem to fool experts. ITRC receives at least a dozen requests each 
week from people asking us to verify a “legitimate” looking scam. One DMV Director 
even forwarded an urban legend to us that contained only partially correct informa- 
tion. He received it “from a reliable source.” 

Mail theft: In a recent conversation with a postal inspector in California, we were 
told that a good portion of identity theft cases involves the post office. Not only is 
it a way to move information, receive “stolen” good and cards but also the mail is 
a rich source of sensitive information. Preapproved credit offers are but one of the 
problem areas. Convenience checks (that come with credit statements — ready to use 
by anyone), any bank/credit/financial statement with an entire account number im- 
printed on the bill, health benefit statement, payroll stubs and statements, literally 
hundreds of sheets that make their way to your home could be intercepted and used 
for identity theft. And the problem is that the post office is not the only location 
to steal this mail. It could be intercepted in a variety of locations — print shop, mail 
room (either outgoing or incoming if returned to sender), postal office and then fi- 
nally your own either locked or unlocked mailbox. Your own roommate, friend, care- 
giver, or family member could look at the mail, steal it, or just use the information. 

Checking account takeover: Checking account takeover is a heinous crime in that 
it can be accomplished in many ways. Your account can be accessed electronically, 
checks that you issue can be reused, and checks can be computer generated using 
your information on the top but a different bank routing and account number on 
the bottom. To date, the financial community and consumer groups have yet to find 
a good solution to this issue. 

Identity theft and other illegal activities: The reality is that identity theft is a way 
to make a lot of money quickly. This automatically draws the attention of narcotic 
dealers, manufacturers and junkies, gamblers, alcoholics, those who compulsively 
spend money and those who sell information (like selling drugs) to make large quan- 
tities of money to live the lifestyle they wish to enjoy. 

Gang behavior, information trafficking and identity theft: Several law enforcement 
groups have now shared that their large cities have given rise to organized identity 
theft rings. These groups control the information selling, teach others how to com- 
mit identity theft, and find the “targets” that will become their mules or information 
gatherers. They may have a division that helps to sell “stolen” merchandise or to 
traffic merchandise on the black market. 

These groups are also setting themselves up as businesses, allowing them access 
to information from groups like the CRA’s and datahouses like ChoicePoint. They 
are finding ways to target groups of people based on a variety of fields — address, 
economic status, last name, ethnicity — so that they can customize the information 
for sale. 

Level of sophistication: Just when we think we have heard the very worst-case 
scenario, another person contacts our office with an even more difficult case. Gangs 
are working smart and even teach each other about our law enforcement and busi- 
ness weak links. There is a reason that some companies are regularly hit and others 
are rarely hit. Instead of opening 5 new credit cards, they open 30. In fact, skim- 
mers may be found with more than 10,000 “new” credit cards ready to sell or use. 
These criminals have become bold and brazen. Why? — why not, especially when so 
few are caught and the crime is so profitable? 
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Three other areas of concern: 

1. Non-English Language Victims: Identity theft is an equal opportunity crime. 
It can strike anyone with a Social Security number. According to the latest census, 
in California one-third of our population is non-English speaking. However, even the 
simpliest task of ordering your credit report is difficult. In both of the CRA’s that 
use automated systems, neither provide an option for even Spanish. Should the vic- 
tim have another person call in for their report on their behalf (trusting their Social 
Security number to yet another stranger/friend), the information sheets which in- 
clude consumer rights, how to understand the report or what to do, come in one lan- 
guage only — English. These same victims face similar situations in contacting credit 
issuers and collection agencies. ITRC has worked with some of these victims — in 
part through a translator and partly in the victim’s native tongue. The frustration 
level is high and their dissatisfaction with the system even higher. Some have given 
up and just paid the bills, fearful of the consequences and not understanding their 
rights. 

2. Deployed Active Duty Military: It is difficult enough to clear up a problem 
of identity theft if you have the time and ability to do so. But you cannot deal with 
a case in a timely manner while deployed — either into a battle zone or in an over- 
seas duty station. At this time we are working with about 20 military personnel. 

ITRC has proposed a plan for a Military Victim Support Program to several legis- 
lators, asking the Department of Defense to consider creating a trained body of JAG 
aides/victim liaison officers who will work with these members, almost as a one-stop 
shop. This program will save money, help to highlight security issues, and assist 
deployed military members as they serve our country, sometimes at great physical 
risk. ITRC will make that plan available to any Committee Member who will help 
us to move this program forward. 

3. Identity Theft and Dominance/Domestic Abuse: Identity theft is the perfect 
tool to dominate, abuse, and harass another individual. More and more we are see- 
ing cases like this. 

Recommendations for Laws 

It is our goal in the next section to illuminate problems reported by victims and 
law enforcement and to provide recommendations for consideration. ITRC has al- 
ways been known as a problem-solver and not a finger-pointer. 

The Finding section of each recommendation is based on ITRC’s research, studies 
widely available, and input by victims, law enforcement, and businesses. For text 
recommendations, please contact the ITRC national office. A * denotes areas of high- 
est priority. 

A final comment. Many of these ideas are common sense, and ITRC hopes that 
the involved entities voluntarily absorb these concepts as standard practices. Legis- 
lative solutions should be a last resort. In fact, voluntary acceptance can be used 
to an advantage as illustrated in the following anecdote: 

Three weeks ago we bought our cell phones from Cingular. Both of us have fraud 
alerts on our reports. We explained to the salesperson at Best Buy that he might 
encounter a delay. He never had heard of fraud alerts through he specializes in one 
of the items that thieves are more likely to buy. Indeed, Cingular did notice the 
fraud alert, my husband went home to answer the telephone call to approve the 
transaction, and with no more than a 15-minute delay we had our phones. Cingular 
voluntarily did the right thing and has a loyal customer due to that. 

1. Police Reports 

Finding: One of the biggest victim complaints is that law enforcement refuses to 
take a crime report in identity theft cases. “You are not the victim, the business 
is.” A secondary problem is jurisdiction, since many of these crimes cross lines both 
geographically and by agency. The victim’s mail may have been stolen in Houston, 
but credit purchases are being made in Virginia and in Oklahoma. Who handles this 
case? The Post Office fraud investigation team, the Houston police, or the sheriff 
in Virginia? 

The other problem facing victims is that without a police report, credit issuers 
simply do not believe you. Bank fraud investigators have stated at legislative hear- 
ings and at conferences that a main determining factor in separating victims from 
those avoiding paying a bill is a crime report. The belief is that a “deadbeat” will 
not file a false police report and take the chance that they will be arrested for that 
action. 

Recommendation: Legislation declaring a person who has learned or reasonably 
suspects that another has unlawfully used his or her personal identifying informa- 
tion may initiate a law enforcement investigation in his or her own local jurisdiction 
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and shall receive a copy of said report. For recommended text, see California P.C. 
530.6 {www.leginfo.ca.gov). 

2. Victim Access to Records on Accounts Opened in His I Her Name 

Finding: The burden of proving one’s innocence lies on the shoulders of the victim. 
In a sense, you must prove a negative — that you did not open the account or make 
the purchases. This requires knowing the application and transaction information. 
If purchases were made in person in New York and you were working in Houston 
that day, you have a chance at being taken seriously. In some cases, victims recog- 
nize the handwriting on an application or know who made the purchase because 
they personally know the perpetrator. 

Recommendation: Legislation that allows the victim of identity theft and the in- 
vestigating law enforcement agency to receive application and transaction informa- 
tion on fraudulent accounts opened in his or her name. Language recommendations: 
California P.C. 530.8 or S. 1742 (Federal bill — author Senator Cantwell). 

3. Declaration of Innocence — Criminal Identity Theft 

Finding: Cases of criminal identity theft are especially difficult because even after 
proving you were not the person who committed the crime (or got the tickets), your 
name remains the “alias” on record. Every time a police officer stops you, when a 
potential employer does a criminal background check or you go out of the country 
on vacation, you wonder if you will be accused of the imposter’s crime yet again. 

Recommendation: Legislation and/or policies to allow a person to petition the 
court for a “factual declaration of innocence.” We recommend that the victim not 
only be issued an official record of that declaration, but also for the State to estab- 
lish a database that would keep these records. If the person loses the paper (most 
carry copies for life), this database would contain the order and a copy of the true 
person’s fingerprint(s) for comparison in the case of another instance of mistaken 
identity. 

4. Statute of Limitations for Lawsuits Involving Identity Theft 

Finding: Identity theft is an unusual crime. Most victims of other types of crime 
are involved from the moment the crime began. If your car is stolen, your house 
is robbed, or you are mugged and your purse taken, you know about the crime al- 
most immediately. This is not true in identity theft. In three studies (FTC, Florida 
Grand Jury, Privacy Rights Clearinghouse), the average victim did not find out until 
12-16 months after the crime first began. By Federal law, the clock starts when the 
crime began, giving identity theft victims only a few months to investigate, assess 
the damage, and find out how the crime may have begun. Many victims take a year 
or more to get to this point. 

Recommendation: Legislation to allow victims of identity theft and financial fraud 
at least a 2-year window to initiate a lawsuit against involved parties, starting from 
time of discovery and not time of when the crime(s) occurred. 

5. Confirmation of Change of Address — Account Takeover 

Finding: Account takeover has been a problem for many years. It is fairly easy 
to find out the credit card number of an individual: Via mail interception, shoulder 
surfing, skimming, register receipts, and scams both by telephone and over the 
Internet. The U.S. Postal Service introduced a successful program that mirrors the 
one recommended in this legislation. It mandates that when an address change is 
requested that a card be sent to the current address on record and to the new ad- 
dress, informing the consumer of the requested change. The card directs the con- 
sumer to notify a toll-free hotline should they dispute the change of address request. 

Recommendation: Legislation mandating that a company must notify the card- 
holder when a change of address is submitted. This change of address notification 
should be mailed by postal mail (not postcards) to the current address on the ac- 
count, as well as the new address. The notice should inform the account holder of 
the request and give a toll-free number to call if the account holder had not sub- 
mitted the change. 

6. Mandatory Observation of Fraud Alerts 

Finding: Current identity theft victims want to stop the perpetrator from opening 
yet another account. Many fear (with good reason) that unless they immediately 
lock the door to credit, the perpetrator will continue to attack them for years to 
come. Even if the imposter is arrested, there is no guarantee that he or she will 
not sell the information to another individual, who in turn will try to open credit 
using the consumer’s information. While California is also experimenting with a 
credit freeze, ITRC believes that the mandatory observation of fraud/security alerts 
is the ultimate credit monitoring service. 
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The only measure of control over the establishment of new credit lines is through 
a fraud or security alert placed with the three major credit reporting agencies. Un- 
fortunately, at this time, the notice of a fraud alert — “Do not issue credit without 
my express permission. I may be reached at 555-565-5555 or please contact me at 

the following e-mail address: ” — is advisory in nature only. Language for this 

bill has been already written by Senator Feinstein. 

Recommendation: Legislation that would require all credit reporting agencies to 
indicate to credit issuers that there is a fraud/security alert and the entire text of 
that alert, whether a credit score, summary, or full report is requested. AND that 
all credit issuers must check for and observe security alert request as written on 
credit reports. This legislation should include penalties and civil remedies for failure 
to comply. 

7. Truncation of Credit Card Account Numbers on Credit Card Receipts 

Finding: Many merchants print your entire credit card number on merchandise 
receipts. Unfortunately, this is an excellent way for thieves to gather information 
and enjoy a shopping spree at your expense. The scenario: It is a busy time, perhaps 
a white sale or during the holidays. As Mary wanders from store to store, she 
doesn’t notice the gray-haired woman walking behind her. She also doesn’t notice 
the woman slipping her hand into Mary’s purchase bag and pulling out the receipt 
for the sweater she bought a few minutes ago. By the time Mary gets home a few 
hours later, this woman (minus the gray-haired wig) has hit two nearby shopping 
centers and charged about $3,000 in merchandise to Mary’s account. 

Recommendation: Legislation that states that a person or an entity that accepts 
credit cards for the transaction of business may not print more than the last 5 digits 
of the credit card account number or the expiration date upon any receipt provided 
to consumers. A 2-year phase out deadline can be included to allow stores to adjust 
programs as they replace or alter machines and software programs. 

8. Free Annual Credit Reports upon Request 

Finding: Credit reporting agencies (CRA’s) collect credit information provided by 
credit issuers, merchants, and others and then resell it to their customers — credit 
issuers, merchants, and employers. That information is not verified for accuracy, 
and may even reflect addresses used by imposters or misread by clerks. The irony 
is that if this information is not accurate, not only does the consumer suffer, but 
the businesses that purchase this information and use it to determine whether to 
extend credit lines can also be harmed. Information distributed by the CRA’s seems 
to take on a life of its own. These reports are replicated and distributed by resellers 
(for example, real estate industry). Errors in reports spread like a malignant growth 
throughout the system, affecting a person’s ability to get credit, buy a house or car, 
obtain a job, and secure rental housing. 

The only way to confirm the database information is to allow the consumer to 
check it over on a regular basis. Currently, the credit reporting agencies charge a 
fee to look at one’s credit report, arguing that they shouldn’t be forced to give any- 
thing away for free. Yet, the only person who can authenticate information is the 
consumer. Why should they be forced to pay to verify information they did not pro- 
vide to the CRA in the first place? 

Recommendation: We recommend following the lead of several other States (Colo- 
rado, Georgia, Massachusetts, Maryland, New Jersey, and Vermont) in allowing 
each consumer one free copy of all three credit reports per year, upon request and 
expand upon it to also follow California’s lead in allowing multiple credit reports 
for victims of identity theft within the first TWO years after the discovery of the 
crime (perhaps one every 3 months). This bill is smart business, good for consumers, 
and good for a State’s economy. 

9. Victim’s Right Act 

Finding: Victims of financial fraud must be given full rights under the law. These 
include the right to reasonable and timely notice of any public proceeding involving 
the crime and of any release or escape of the accused; the rights not to be excluded 
from such public proceeding and reasonably to be heard at public release, plea, sen- 
tencing, reprieve, and pardon proceedings; and the right to adjudicative decisions 
that duly consider the victim’s safety, interest in avoiding unreasonable delay, and 
just and timely claims to restitution from the offender. 

Recommendation: Legislation that would require the victim to be notified of all 
steps of the criminal process including the trial date and the release of the perpe- 
trator from custody. Provisions should be made to allow for victim input prior to 
sentencing and for restitution when appropriate. Victims of white-collar crimes 
should be afforded the same rights as those of violent crimes. 
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10. Information Trafficking 

Finding: As identity theft has grown, suspects have become actively engaged in 
the collection of personal profiles for purposes of identity theft. These suspects often 
steal mail and trash in search of new identities to use. They compile lists of victims’ 
names, hirth dates. Social Security numbers, maiden names, addresses, and other 
pieces of information that can be used to open fraudulent accounts or take over ex- 
isting legitimate accounts. These profiles have become commodities that can be sold 
or traded for drugs or cash. Often the person compiling the profile is not directly 
involved in the actual use of the identifiers, thereby avoiding prosecution as an 
“identity thief.” In some cases, suspects have retained victim profiles for years, 
knowing they can be used again and again. 

Recommendation: Legislation making the action of information trafficking illegal 
and punishable as a felony or felony/misdemeanor (wobbler) depending on judicial 
discretion. Possible language includes: Every person who, with the intent to defraud, 
acquires, transfers, or retains possession of the means of identification of another 
person without the authorization of that person, is guilty of a public offense, and 
upon conviction therefore, shall be punished (terms equal to type of crime). The 
term “means of identification” means any name together with one or more other 
pieces of information which can be used to identify a specific individual, including 
a Social Security number, date of birth. State or Federal issued driver’s license or 
identification number, taxpayer identification number, or unique biometric data, 
such as fingerprint, voice print, retina or iris image. 

11. Confidentiality and Protection of the Social Security Number (SSN) 

Finding: The Social Security number is the golden key to financial identity theft. 
However, it is used by so many entities that it is nearly impossible for consumers 
to adequately protect it. New standards and laws need to be adopted that dictate 
collection, use, display, security, and confidentiality of the Social Security number. 
It should not be used as an identifier by schools, insurance companies, employers, 
utility companies, or businesses. Social Security numbers should not be publicly dis- 
played (that is, printed on timecards or badges) or shared with other companies or 
organizations except where required by law. ITRC would hope that business groups 
would voluntarily adopt many of the recommendations in this section and that legis- 
lation be a last resort. 

Finding: Companies often ask for information that is not necessary for the trans- 
action of business. They claim that they may need it at a future time or for statis- 
tical purposes. There should be some restriction of the type of information asked on 
applications. For example, a self-storage company and a health club were recently 
asked why they requested the person’s Social Security number. The response was 
that it was a convenient identity number to use as a member number. 

Recommendation: Legislation prohibiting the use of the Social Security number as 
an identifier, except for specified governmental purposes. Entities that should not 
be using the Social Security number as an identifier include: Schools, insurance 
companies, employers, utility companies, or businesses. Both civil and business code 
penalties may need to be imposed on those who do not comply with these standards. 
Again, a phase-out program can be implemented to minimize costs to those entities 
that now use the Social Security number as the customer identity number. 

Recommendation: Legislation restricting circumstances in which a company/gov- 
ernmental agency may ask for certain identifying information including Social Secu- 
rity number, birth date, and driver’s license number. This recommendation includes 
the requirement that all States convert to non-Social Security number for driver’s 
license number use rather than allowing the consumer an option. 

Finding: Information is often exchanged in an unsafe manner. Those individuals 
collecting information must be trained on how to collect data in a manner that does 
not compromise the security of consumers or employees. That means that informa- 
tion should not be exchanged verbally in a public place, where the conversation may 
be overhead. How many times have you seen a pharmacist ask for a Social Security 
number in order to process a prescription? Who is overhearing that conversation? 
How many times have you seen a retail clerk phone in a credit application while 
standing in a workstation surrounded by shoppers? Even once is too often. 

Finding: Personal information on databases should be encrypted and accessed 
only on a “need-to-know” basis. These people should have access audited and their 
computers must be password controlled. Ideally, these people should all have crimi- 
nal and financial background checks performed on a regular basis. 

Recommendation: Only the personal information relevant to the purpose to be 
used should be requested. It must be limited to “need-to-know” personnel, and ac- 
cess of information strictly audited and controlled. Consumers and employees must 
be notified in advance as to the purposes of the data collection, to whom it will be 
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distributed, and the subsequent use after the fulfillment of the original purpose. 
Legislation should include anticoercion language so that consumers will not be pe- 
nalized if they wish to “opt out” of additional services/lists or denied services if they 
do not wish to provide sensitive information not essential to business operations. 

Recommendation: No person or entity shall sell, give away, or in any way allow 
distribution or use of information collected or provided to governmental agencies 
other than the original purpose for which the information was requested. 

Recommendation: Personal data should be protected by reasonable security safe- 
guards against such risks as loss or unauthorized access, destruction, use, modifica- 
tion, or disclosure of data. If this occurs, legislation should be in place to allow for 
civil litigation and possible punitive actions by the courts. 

12. Effective Disposal of Records No Longer Needed 

Finding: The privacy and financial security of individuals is increasingly at risk 
due to the widespread collection of personal information by both the private and 
public sectors. Credit transactions and applications, magazine subscriptions, tele- 
phone numbers, real estate records, automobile registrations, consumer surveys, 
warranty registrations, credit reports, employee records, pharmacy records, mort- 
gage or banking applications, and Internet sites are all sources of personal informa- 
tion and form the source material for identity thieves. Consumers must trust that 
companies are adequately destroying information no longer stored. Unfortunately, 
investigative reporters around the country are finding compromising information in 
dumpsters behind buildings on a regular basis. 

Recommendation: Legislation requiring businesses to take all reasonable steps to 
destroy, or arrange for the destruction of a customer’s or employee’s records within 
its custody or control containing personal information which is no longer to be re- 
tained by the business by shredding, erasing, or otherwise modifying the personal 
information in those records to make it unreadable or undecipherable through any 
means. This should include records on paper and those stored electronically. 

13. Security Breaches (Workplace Identity Theft) 

Finding: The concealment and notification delay to concerned parties of informa- 
tion breaches involving the theft or possible theft of identifying information must 
stop. The incidents at the Stephen P. Teale Data Center and the University of 
Texas/Austin in which the personal financial information of hundreds of thousands 
fall into the hands of computer hackers is a dramatic demonstration of an all too 
common event. This bill MUST include both computer breaches and paper breaches 
of information or it will not be complete. 

Recommendation: Legislation needs to be considered that would require a timely 
notification to all parties involved in a breach containing their personal identifying 
information. 

Recommendation: An individual should have the right to verify the accuracy of in- 
formation collected about him or her without charge and in a form that is readily 
intelligible to him or her. They should be able to challenge data recorded in error, 
and if the challenge is successful to have the data erased, rectified, completed, or 
amended. 

14. Protecting Information from Mail Theft 

Finding: Mail theft is a major source of information for identity thieves. When 
consumers do not know that an item is being sent to them, they are unable to report 
its loss. We also have to make sure that any document being sent via mail does not 
include a full Social Security number or account number. 

Recommendation: Require prior consumer consent via an opt in program for 
preapproved credit card offers and convenience/balance forward checks sent through 
the mail. This program would also require that consumers be notified of expected 
mailings so they can monitor in the event it is not received. Another way to tackle 
this problem is to prohibit any changes in the original form sent to the consumer 
or allow any forms that are incomplete (In other words, a thief may not know my 
birth date and leave it blank). In terms of other documents, the Social Security 
number must be eliminated from mailings, including paycheck stubs. The employee 
identity number (other than Social Security number) could be used in its place. 

15. Consumer Notification of Excessive Applications or Negative Information 
on Credit Reports 

Finding: Credit granters are aware that there are recognized warning signals that 
indicate possible financial identity theft: Multiple applications within a short period 
of time, multiple applications with the same Social Security number but different 
addresses, etc. The problem has been that no one credit issuer sees all the applica- 
tions. The only entities that have access to this information are the CRA’s. 



183 


Recommendation: Legislation that requires the CRA to notify a consumer at all 
the addresses on record for the past 6 months of a possible fraud situation should 
more than four (4) credit applications he submitted within a 30-day period of time. 

Finding: Consumers do not often find out about negative information on a credit 
report until the worst possible time — when applying for credit, a job, or tenancy. 
And this may be due to the consumer’s own actions, those of an imposter, or clerical 
errors. 

Recommendation: Legislation that requires the CRA’s to notify a consumer of any 
negative information submitted to the CRA at the time of submission. This legisla- 
tion may stipulate that no more than four (4) notifications are required in any one 
calendar year unless a fraud or security alert is currently on that credit report. 

ITRC’s Position About Identity Theft and FCRA Sunsetting 

1. Identity theft crosses State borders and many of the crimes we hear about are 
both cross-geographic and multi-jurisdictional in nature. This creates a loophole in 
which identity thieves thrive. It is one that we can, by working as a unit, finally 
close. National standards supported and aided by State involvement is essential. 

2. A cohesive, uniform set of laws that would keep sensitive information out of 
criminal’s hands, strengthen credit issuing standards and assist victims is badly 
needed. The question that has not yet been answered is whether a single set of Fed- 
eral laws can do the job. 

3. While strong national laws will reduce the need or desire for fine-tuning via 
State laws there may always be a need for the States to address individual issues — 
in response to consumer/business needs of that State and to enhance the ability for 
local law enforcement and prosecutors to pursue actions on behalf of those who live 
in that State. 

4. We do not agree with the concerns on businesses and other groups that they 
will need to conform to 50 different standards. That is speculative at best and prior 
to 1996 was not an issue. A dual regulatory system has worked well in other areas 
and can work to the betterment of all in regards to FCRA as well if needed. 

5. We are well aware that as a victim resource center that interacts with business 
that to take a diehard approach that would drastically impair or negatively impact 
business ability to function will be just as devastating to the victims we assist. We 
seek a cooperative meeting point between the business, consumer, and victims so 
that we can defeat the one true enemy of all of us — the thieves. 

6. To discuss FCRA preemptions is premature until we see the set of new, signed 
laws that are adopted as national laws. As in the last 5 years, there has been much 
talk but little action in the last 6 months, since the preemption discussion was 
opened and identity theft was thrust into the spotlight. Once those laws are signed, 
then we can discuss preemption. Until that time, this is like filing for retirement 
before you have been offered your first job. 

Conclusion 

Crime, like most things in our society grows, evolves, and constantly changes. In 
1970, the writers of the FCRA could not have predicted that credit transactions 
would be conducted via the Internet. All business was conducted in person, in com- 
munities where people were known and applications could be verified. 

When President Franklin Delano Roosevelt expanded the use of the Social Secu- 
rity number as an identifier, he could not have anticipated the Pandora’s box that 
he would open. It was impossible to predict the impact of the information age and 
how computer technology would allow a crime like identity theft to flourish. 

The FCRA preemption discussion has created more activity and talk of action in 
the last 6 months than in the last 5 years combined. In 2000, the FTC held a hear- 
ing on identity theft in which we participated. They have continued to monitor this 
crime through their database and through victim panels. The information has not 
changed, just the number of victims which has increased. 

ITRC’s staff members have attended hearings and provided information for years 
now to Federal legislators and governmental agencies about changes that need to 
be made — to no avail. Few, if any, bills have been passed. The most recent was 
passed because of its link to Homeland Security (higher penalties — for all those 
criminals who are not caught in the first place). 

While the Federal Government shows an interest in identity theft, it has been the 
States that have led the way in restricting information access and victim recovery. 
These legislative bodies have shown a responsiveness that is unmatched to date at 
the Federal level. (See addendum.) 

If you are serious about identity theft and feel you can address it sufficiently on 
a national basis, this is your opportunity to prove it. But keep in mind, we (con- 
sumers, victims, law enforcement, advocates, and the business community who cares 
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about combating this crime) have high standards for the laws that you pass. We will 
not accept weak laws that either do little to help the situation or weaken existing 
laws that have a proven history. 

ITRC’s sole purpose is to combat this crime and to help victims. Our fear is that 
the public will be promised new laws, strong laws that allow for expansion and redi- 
rection as this crime grows and evolves but will never see them. Our fear is that 
the promise will be made but once groups interested in renewing the FCRA preemp- 
tions wins, these news laws will cease to be discussed, let alone passed. 

At this time, ITRC wants to see some action. We want to see what the new laws 
say, who they protect, what they address, and how they will affect both businesses 
and consumers, neither of which can be disregarded nor harmed. Until those laws 
are passed and signed by the President, discussing preempting States from passing 
laws is premature. 

Thank you for your time and consideration. 

* ^ * 

Addendum 

California vs. Federal laws that have been passed in the last 3 years in response 
to consumer/victim/law enforcement feedback. 

California State Laws 

Confidentiality of Social Security Numbers — California Civil Code Section 1798.85 
-1798.86 and 1786.6. This law restricts businesses from publicly posting or dis- 
playing Social Security numbers. The law takes effect gradually from July 1, 2002 
through July 1, 2005. 

Consolidation of Identity Theft Cases — Penal Code Section 786. The jurisdiction 
for a criminal action for identity theft offenses may be the county where the theft 
occurred or the county where the information was illegally used. If similar identity 
theft offenses occur across multiple jurisdictions, any one of those jurisdictions is a 
proper jurisdiction for all of the offenses. 

Consumer Credit Reporting Agencies Act Civil Code Section 1785.1-1785.36. This 
law, the State counterpart of the Fair Credit Reporting Act, regulates consumer 
credit reporting agencies. It requires them, among other things: (1) to proyide free 
copies of credit reports to consumers who have been denied credit or who are iden- 
tity theft victims, (2) to block information that appears on a report as the result 
of identity theft, (3) to place security alerts (effective July 1, 2002) or freezes (effec- 
tive January 1, 2003) on the files of consumers who request them, and (4) to pro- 
vide, for a reasonable fee, credit score information to consumers who request it. 

Credit Card Number Truncation — California Civil Code Section 1747.9. No more 
than the last five digits of a credit card number may be printed on the electronic 
receipts. Effective on January 1, 2001 for machines put in use on or after that date. 
Effective on January 1, 2004 for all machines that electronically print credit card 
receipts. 

Credit Card “Skimmers” — Penal Code Section 502.6. The knowing and willful pos- 
session or use, with the intent to defraud, of a device designed to scan or reencode 
information from or to the magnetic strip of a payment card (a “skimmer”) is pun- 
ishable as a misdemeanor. The devices owned by the defendant and possessed or 
used in violation may be destroyed and various other computer equipment used to 
store illegally obtained data may be seized. 

Destruction of Customer Records — California Civil Code Sections 1798.80-1798.84. 
This requires businesses to shred, erase, or otherwise modify the personal informa- 
tion in records under their control. 

Employment of Offenders — Penal Code Sections 4017.1 and 5071 and Welfare and 
Institutions Code Section 219.5. Specified prison and county jail inmates may not 
have access to personal information. The same prohibitions apply to specific offend- 
ers performing community service in lieu of a fine or custody. 

Identity Theft: Access to Financial Records on Fraudulent Accounts — California 
Civil Code Section 1748.95, California Financial Code Sections 4002 and 22470. 
Similar to Penal Code Section 630.8, these laws require certain types of financial 
institutions to release (to a victim with a police report or to the victim’s law enforce- 
ment representative) information and evidence related to identity theft. 

Identity Theft — California Penal Code Sections 530.5-530.8. These code sections 
define the specific crime of identity theft, require the law enforcement agency in the 
victim’s area to take a police report, allow a victim to get an expedited judicial rul- 
ing of factual innocence, require the Department of Justice to establish a database 
of identity theft victims accessible by law enforcement and victims, and require the 
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financial institutions to release information and evidence related to identity theft to 
a victim with a police report or to the victim’s law enforcement representative. 

Identity Theft Conspiracy I DMV — Penal Code Sections 182 and 529.7. Courts can 
impose fines of up to $25,000 on individuals convicted of felony conspiracy to commit 
identity theft. This law also makes it a misdemeanor for any unauthorized person 
to obtain (or assist another person in obtaining) a driver’s license, identification 
card, vehicle registration certificate, or other official document issued by the Depart- 
ment of Motor Vehicles, with the knowledge that the person obtaining the document 
is not entitled to it. 

Identity Theft Victim’s Rights Against Claimants — Civil Code Section 1798.92- 
1798.97. This law protects identity theft victims who are being pursued for collection 
of debts which have been created by identity thieves. The law gives identity theft 
victims the right to bring an action against a claimant who is seeking payment on 
a debt NOT owed by the identity theft victim. The identity theft victim may seek 
an injunction against the claimant, plus actual damages, costs, a civil penalty, and 
other relief. 

Information Practices Act of 1977 — California Civil Code Sections 1798 and fol- 
lowing. This law applies to State government. It expands upon the constitutional 
guarantee of privacy by providing limits on the collection, management, and dis- 
semination of personal information by State agencies. 

Insurance Information and Privacy Protection Act, Insurance Code Section 791 et 
seq. This law limits most insurance companies from disclosing personal information 
about a consumer that is collected or received in connection with an insurance 
transaction, for example, (1) when a consumer provides written authorization for a 
disclosure, or (2) when a disclosure is necessary for conducting business. The law 
permits the disclosure of nonsensitive information for marketing purposes unless 
the consumer opts out. 

Investigative Consumer Reporting Agencies Act, California Civil Code Sections 
1786-1786.60. This law regulates the activities of agencies that collect information 
on consumers for employers, insurance companies, and landlords. 

Legal and Civil Rights of Persons Involuntarily Detained — Welfare & Institutions 
Code Section 5328. This law provides for the confidentiality of the records of people 
who are voluntarily or who are involuntarily detained for psychiatric evaluation or 
treatment. 

Mandated Blood Testing and Confidentiality to Protect Public Health — California 
Health & Safety Code Sections 120975-121020. This law protects the privacy of indi- 
viduals who are the subject of blood testing for antibodies to the probable causative 
agent of acquired immune deficiency syndrome (AIDS). 

Notice of Security Breach — Civil Code Sections 1798.29 and 1798.82. This law re- 
quires a business or a State agency that maintains unencrypted computerized data 
that includes personal information, as defined, to notify any California resident 
whose unencrypted personal information was, or is reasonably believed to have 
been, acquired by an unauthorized person. The type of information that triggers the 
notice requirement is the name plus one or more of the following: Social Security 
number, driver’s license, or State identity card number, or financial account num- 
bers. The law’s intention is to give affected individuals the opportunity to take 
proactive steps to protect themselves from identity theft. These provisions take ef- 
fect July 1, 2003. 

Office of Privacy Protection — California Business and Professions Code Section 
350-352. A State law enacted in 2000 created the Office of Privacy Protection, with 
the mission of protecting and promoting the privacy rights of California consumers. 
http:! / www.leginfo.ca.gov / cgi-bin I displaycode?section=bpc&group=00001- 
01000&file=350-352. 

Payment by Check or Credit Card — Civil Code Sections 1725 and 1747.8. Any per- 
son accepting a check in pa3unent for most goods or services at retail is prohibited 
from recording a purchaser’s credit card number or requiring that a credit card be 
shown as a condition of accepting the check (Section 1725). Any person accepting 
a credit card in payment for most goods or services is prohibited from writing the 
cardholder’s personal information on forms associated with the transaction (Section 
1747.8). 

Patient Access to Medical Records — California Health & Safety Code Section 
123110 et seq. With minor limitations, this law gives patients the right to see and 
copy information maintained by health care providers relating to the patients’ 
health conditions. The law also gives patients the right to submit amendments to 
their records, if the patients believe that the records are inaccurate or incomplete. 

Personal Information Collected on Internet — California Government Code Section 
11015.5. This law applies to State government agencies. When collecting personal 
information electronically, agencies must provide certain notices. Before sharing an 
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individual’s information with third parties, agencies must obtain the individual’s 
written consent. 

Public Records Act — California Government Codes Sections 6250-6268. This law 
applies to State and local government. It gives members of the public a right to ob- 
tain certain described kinds of documents that are not protected from disclosure by 
the Constitution and other laws. It also requires that State and local agencies be 
“mindful” of the laws that confer privacy rights. This law also provides some specific 
privacy protections. 

Spam Laws — California Business and Professions Code, Section 17538.4 and 
17538.45 — Penal Code Section 502. These code Sections establish the guidelines re- 
lating to unsolicited e-mail and faxes. 

State Agency Privacy Policies, Government Code Section 11019.9. This law re- 
quires State agencies to enact and to maintain a privacy policy and to designate an 
employee to be responsible for the policy. The policy must describe the agency’s 
practices for handling personal information, as further required in the Information 
Practices Act. 

Substitute Credit Cards — Civil Code Section 1747.05. A credit card issuer that 
issues a substitute credit card must provide an activation process where consumers 
are required to contact the card issuer to activate the credit card before it can be 
used. 

Supermarket Club Card Act — Civil Code Title 1.4B. This law prohibits super- 
market club card issuers from requesting drivers license number or Social Security 
number and from selling or sharing personal customer information; limited exemp- 
tion for membership card stores. 

Telemarketing: State Do-Not-Call List — Business and Professions Code Sections 
17590-17595. Effective April 1, 2003, Californians can put their residential and cel- 
lular telephone numbers on a State do-not-call list. For program details, visit the 
Attorney General’s website at http: ! lcaag.state.ca.usldonotcalllindex.htm. 

Unsolicited Cell Phone! Pager Text Ads — Business and Professions Code Section 
17538.41. This law prohibits the sending of unsolicited text advertisements to cell 
phones or pagers. 

Warranty Cards — Civil Code Section 1793.1. Product warranty cards must clearly 
state that the consumer is not required to return the card for the warranty to take 
effect. 

Federal Laws 

Children’s Online Privacy Protection Act (COPPA) — 15 U.S.C. 6501 et seg. The 
Act’s goal is to place parents in control over what information is collected from their 
children online. With limited exceptions, the related FTC Rule requires operators 
of commercial websites and online services to provide notice and get parent’s con- 
sent before collecting personal information from children under 13. 

Driver’s Privacy Protection Act of 1994 — 18 U.S.C. 2721 et seq. This law puts lim- 
its on disclosures of personal information in records maintained by departments of 
motor vehicles. 

Fair Credit Reporting Act (FCRA) — 15 U.S.C. 1681-1681u. This Federal law is de- 
signed to promote accuracy, fairness, and privacy of information in the files of every 
“consumer reporting agency,” the credit bureaus that gather and sell information 
about consumers to creditors, employers, landlords, and other businesses. 
www.ftc.gov i bcp i coniine i edcams ifcra i index, html. 

Family Educational Rights and Privacy Act of 1974 (FERPA) — 20 U.S.C. 1232g. 
This law puts limits on disclosure of educational records maintained by agencies 
and institutions that receive Federal funding. 

Federal Identity Theft Assumption and Deterrence Act of 1998 — 18 U.S.C. 1028. 
The Act makes it a Federal crime to use another’s identity to commit an activity 
that violates Federal law or that is a felony under State or local law. Violations are 
investigated by Federal agencies including the Secret Service, the FBI, and the 
Postal Inspection Service and prosecuted by the U.S. Department of Justice. 
www4.law.cornell.edu i uscode i 18 / 1028.html. 

Federal Privacy Act of 1974 — 5 U.S. Code 552a. This law applies to the records 
of Federal Government executive and regulatory agencies. It requires such agencies 
to apply basic fair information practices to records containing the personal informa- 
tion of most individuals. 

Financial Services Modernization Act, Gramm-Leach-Bliley (GLB), Privacy Rule — 
15 U.S.C. 6801-6827. The 1999 Federal law permits the consolidation of financial 
services companies and requires financial institutions to issue privacy notices to 
their customers, giving them the opportunity to opt out of some sharing of person- 
ally identifiable financial information with outside companies, www.ftc.gov i privacy j 
glbact lindex.html. 
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Health Information Portability and Accountability Act of 1996 (HIPAA), Standards 
for Privacy of Individually Identifiable Health Information, Final Rule — 45 CFR 
Parts 160 and 164. HIPAA includes provisions designed to save money for health 
care businesses by encouraging electronic transactions and also regulations to pro- 
tect the security and confidentiality of patient information. The privacy rule took 
effect on April 14, 2001, with most covered entities (health plans, health care clear- 
inghouse, and health care providers who conduct certain financial and administra- 
tive transactions electronically) having until April 2003 to comply, http'.ll 
aspe. hhs.gov / admnsimp / bannerps.htmttprivacy. 

Telephone Consumer Protection Act (TCPA) — 47 U.S.C. 227. This law puts restric- 
tions on telemarketing calls and on the use of autodialers, prerecorded messages, 
and ftix machines to send unsolicited advertisements. 

Video Privacy Protection Act of 1998 — 18 U.S.C. 2710. The Act strictly limits the 
conditions under which a video rental or sales outlet may reveal information about 
the outlet’s patrons. The Act also requires such an outlet to give patrons the oppor- 
tunity to opt out of any sale of mailing lists. The Act allows consumers to sue for 
money damages and attorney fees if they are harmed by a violation of the Act. 


PREPARED STATEMENT OF WILLIAM HOUGH 

Vice President of Credit Services, The Neiman Marcus Group 
On Behalf of the National Retail Federation 

June 19, 2003 

Good afternoon. My name is Bill Hough. I am Vice President of Credit Services 
for The Neiman Marcus Group. I am testifying today on behalf of the National 
Retail Federation. I would like to thank Chairman Shelby and Ranking Member 
Sarbanes for providing me with the opportunity to testify before the Banking Com- 
mittee about the growing problem of identity theft and the steps that Neiman 
Marcus is taking to curb our losses and protect our customers from these crimes. 

By way of background. The Neiman Marcus Group is headquartered in Dallas, 
Texas, and is comprised of two primary operating segments: Specialty retail (which 
includes 35 Neiman Marcus stores nationwide and two Bergdorf Goodman stores in 
New York City) and direct marketing (which includes the catalogue and online oper- 
ations for our Neiman Marcus, Horchow, and Chef’s brands). We issue our propri- 
etary credit cards under the Neiman Marcus and Bergdorf Goodman names. 

The National Retail Federation (NRF) is the world’s largest retail trade associa- 
tion with membership that comprises all retail formats and channels of distribution 
including department, specialty, discount, catalogue, Internet, and independent 
stores. NRF members represent an industry that encompasses more than 1.4 million 
U.S. retail establishments, employs more than 20 million people — about 1 in 5 
American workers — and registered 2002 sales of $3.6 trillion. 

In fiscal 2001, Neiman Marcus reached a high-water mark for identity theft re- 
lated losses with just over 520 cases representing a total expense of $1.3 million. 
In the past 2 years, we have experienced a decline of approximately 70 percent in 
the number of identity theft fraud cases with less than 150 cases projected for the 
current year. It is important to note that cases involving other forms of fraud, such 
as lost or stolen cards have remained constant over the past 2 years. 

Mr. Chairman, instant credit represents about 86 percent of all new accounts 
opened at Neiman Marcus. As you know, this process is most likely to take place 
at the point of sale and relies on a highly automated and relatively quick procedure 
to verify an applicant’s identity and check that individual’s credit report. In order 
to cut down on fraud and identity theft during the instant credit application, 
Neiman Marcus developed a custom fraud detection model that analyzes certain 
specific attributes of every credit application. This system isolates certain variables 
on an application and double-checks them against the information found on the ap- 
plicant’s credit report. Where discrepancies or inconsistencies occur, the model sends 
the application to our credit department for further review. Clearly, the model we 
developed works well and has reduced our losses significantly over tbe past 2 years. 
Additionally, another positive byproduct of the model is that it has identified and 
prevented many more identity theft cases (about 800 in the past year). 

Occasionally, we are able to definitively detect an attempted fraud and arrest the 
identity thief in our store. This usually occurs if our credit office, after being alerted 
during the application process, can quickly get in touch with the victim by calling 
a phone number provided through the credit bureau information. We will then ask 
if they want to pursue an arrest of the person attempting to use their personal 
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information to open a credit account. If they agree, we will authorize a credit card 
number and allow the clerk to open the account and complete the transaction. At 
that point, Neiman Marcus Loss Prevention will detain the suspect and contact the 
police. We have had 33 such arrests this year, and 80 in 2002. 

Another program that Neiman Marcus has used to dramatically cut down on 
fraud is administered through our direct marketing division. Currently, Neiman 
Marcus Direct packs and ships approximately 10,000 packages per day for our 
Neiman Marcus, Horchow, and Chef’s brands. We also ship about 5,000 packages 
from our specialty retail stores each day. By using customer information-sharing we 
were able to develop an address delivery cross-check within our Delivery Manifest 
System. Thus, each package is passed through this address verification to make 
sure it is not going to a known bad delivery address. Additionally, edits are in place 
to identify unusual buying patterns that may be forwarding merchandise to a cer- 
tain address. These controls stopped over 500 fraudulent shipments last year. 

Neiman Marcus also does special edits to focus on the hottest selling merchandise, 
knowing that these items often have the highest street sale value. In fact, a savvy 
sales clerk at the Neiman Marcus in White Plains, New York, helped to expose one 
of the largest identity theft rings in U.S. history involving a former employee of 
Teledata and over 30,000 stolen credit reports from the three major credit bureaus. 
The incident began when a woman called in an order for $6,000 in trendy shoes to 
the White Plains store and told the sales clerk she did not care what size shoes were 
shipped to her. The sales clerk realized this was a suspicious transaction and noti- 
fied the Loss Prevention Department at Neiman Marcus who helped set up a con- 
trolled delivery with the local law enforcement and the U.S. Postal Service. 

Mr. Chairman, I would like to be able to tell you that Neiman Marcus has 
prevented 100 percent of all fraudulent credit applications this year, but I cannot. 
Successful identity thieves still slip by our systems at a rate of 7 per every 10,000 
applications processed — less than one-tenth of 1 percent. This, in my view, is not 
the result of a flawed system, but the result of determined criminals with sophisti- 
cated tools like computers and the Internet. You see, the most successful identity 
thieves know how to replicate an individual’s verifiable identity characteristics, 
including producing near-perfect identity documents such as State-issued driver’s 
licenses and counterfeit credit cards. 

Thieves are always looking for the weakest link in any system in order to per- 
petrate a crime. Today, identity theft and unauthorized access to existing accounts 
Uuch as unauthorized account look-up or account takeover) seem to be the name 
of the game. Both of these crimes rely on being able to present yourself using some- 
one else’s identity information. For these types of criminals there is very little else 
we can do to detect and prevent the crime, and retailers, like other businesses, are 
looking to the States and the Federal Government to begin producing the 
most secure and fool-proof identity documents possible. Some have proposed the use 
of biometrics or magnetic strip authentication to verify an individual’s identity. 
Whatever the mechanism, it behooves retailers, banks, and governmental bodies 
alike to make identity security a top priority. In fact, the NRF is in the beginning 
stages of creating a public-private partnership to focus on identity security and its 
implications for both preventing identity theft, as well as helping victims put their 
credit records back together again. 

The need for tougher law enforcement statutes is critical. While we will arrest ap- 
proximately 250 fraud perpetrators this year, many of these criminals are out on 
the street the next day with a slap on the wrist. It is almost as though they are 
being treated as a harmless pickpocket versus a serious criminal who has created 
havoc for an innocent victim. These people, especially those that become multiple 
offenders, must face stiffer sentences if we are going to stop this type of crime. 

With identity theft representing such a small fraction of total credit applications, 
it is often a case of looking for a needle in a haystack. Further, identity thieves 
thrive on anonymity and rely on the assumption that large retailers such as Neiman 
Marcus cannot put a name and face together in order to prevent fraud. This is why 
it is so important for retailers to know their customers, and the only way we can 
do this is through the use of information. Information flows between Credit Services 
and the credit bureaus or between our Retail Division and Direct Marketing Divi- 
sion, combined with sophisticated technology and scoring models, cuts down on 
fraud and allows us to offer exceptional customer service. These two benefits are not 
mutually exclusive and the type of information we collect from each customer and 
its uses is explained clearly in the Neiman Marcus Security and Privacy policy that 
can be found online at www.NeimanMarcus.com. 

At Neiman Marcus, we also have a Fraud Unit that specializes in handling all 
types of fraud claims. These associates are specially trained to assist and guide 
identity fraud victims through a very complicated ordeal. In fact, a call from our 
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Fraud Unit can be the first indication that a consumer may have of suspicious activ- 
ity on their account or of a potential identity theft in progress. You can be sure that 
if an identity thief is tr3ring to open accounts in our store, they are probably at- 
tempting to do the same thing at several other locations as well. 

Identity theft is a crime with at least two victims, the individual whose identity 
was stolen and the business from which money or merchandise was stolen. Clearly, 
it is the individual victim that is most directly hurt, but, if identity theft crimes con- 
tinue to rise at the rate reported by the FTC, all consumers will ultimately pay as 
business losses are passed back to customers. We, at Neiman Marcus, are convinced 
that our systems are making a difference, but we also do not intend to sit on our 
hands waiting for criminals to find the next weakest link. Mr. Chairman, I ask that 
Congress think carefully before blocking information flows or constraining busi- 
nesses to specific prevention techniques or responses. We, in business, must con- 
tinue to have the leeway to innovate to respond to constantly changing variables. 
Criminals always find a way and we need to maintain the ability to find a response. 

In closing, I would like to emphasize the retail industry’s strong support for the 
permanent reauthorization of the seven areas of preemption contained in Section 
624 of the Fair Credit Reporting Act. The current uniform national standards allow 
retailers and lending institutions to get a complete and accurate picture of a per- 
son’s credit history, as well as prevent fraud and identity theft. Consumers have 
come to expect efficient and secure access to credit when purchasing everything 
from an automobile to consumer goods such as furniture, appliances, and apparel. 
In the final analysis, we in the retail industry have a real concern that a more frag- 
mented approval processes for credit would negatively impact consumers in many 
different levels and, as a consequence, retail sales, ultimately costing jobs and hurt- 
ing the economy as a whole. 

I appreciate the opportunity to testify here today. I look forward to answering 
your questions, as well as those of the Committee. Thank you. 


PREPARED STATEME N T OF MICHAEL W. NAYLOR 

Director of Advocacy, AARP 

June 19, 2003 

Good morning. Chairman Shelby, Ranking Member Sarbanes, and other distin- 
guished Members of the Senate Banking, Housing, and Urban Affairs Committee. 
My name is Michael Naylor. I am the new Director of Advocacy at AARP. 

I want to take advantage of my first appearance before the Committee to intro- 
duce myself to you in my new role at AARP. I also want to take a moment to stress 
my strong desire to work closely with you on the full range of issues that come be- 
fore this Committee which are of interest to our Members — and to midlife and older 
Americans generally. 

Let me begin by offering our views regarding the important subject of this hear- 
ing: “The growing problem of identity theft and its relationship to the Fair Credit 
Reporting Act.” I will summarize some important research that we have conducted 
which has guided AARP’s thinking about these important issues. I have attached 
as appendices to my written remarks the results of two key studies that underpin 
today’s testimony. i 

Identity theft is the co-opting of names. Social Security numbers, credit card num- 
bers, or other pieces of personal information for fraudulent purposes. The fraud 
most often perpetrated takes the form of using someone else’s account identity for 
purposes of financial theft. It can also take the form of an impostor — that is, some- 
one assuming another person’s identity in order to seek payment under false pre- 
tenses for provision of professional or other services — and to avoid accurate identi- 
fication or detection. 

Identity theft occurs when an individual’s personal identifying information (for ex- 
ample, name. Social Security number, date of birth, or mother’s maiden name) is 
stolen by another person and used to commit fraud or engage in other unlawful 
activities. Often this stolen information is used to establish credit, run up debt, or 
take over existing financial accounts. Typically, identity theft damages the victim’s 
credit, making it difficult for the victim to buy a home or car, rent an apartment, 
obtain employment, or purchase insurance. 


iSee attached: “Identity Theft: Experience of Older Complainants,” and “The Fair Credit Re- 
porting Act: Issues and Policy Options.” 



190 


Victims can often spend substantial amounts of time and money resolving prob- 
lems created by identity theft. Common problems include the victim’s having to con- 
tact credit bureaus repeatedly in an attempt to clear his or her credit reports of 
fraudulent accounts, being turned down for credit based on the incorrect information 
contained in the victim’s credit report, and receiving calls from creditors seeking to 
collect on the fraudulent accounts. 

I mentioned two studies. The first study confirms the seriousness of the identity 
theft problem for older persons. With a membership of over 35 million persons, 
AARP views, with alarm, the risk that identity theft poses to the personal security 
of all Americans, young and old, well-educated or not. However, our research does 
indicate a greater vulnerability of older Americans, based on the higher proportion 
of those age 50 years and older who report being victimized by identity theft, com- 
pared to the proportion of all age groups making such reports. The second study rep- 
resents an extensive review of the research literature on the Fair Credit Reporting 
Act. This AARP report describes the range of risks faced by consumers that result 
from erroneous information (elements) — some resulting from identity theft. A vari- 
ety of policy options for reform of FCRA emerged from this examination. 

We should recognize that all Americans are vulnerable to the fraudulent use of 
their — or someone else’s — personal information. After all, we are known as the infor- 
mation society. But mid-life and older Americans are particularly vulnerable targets 
for this type of criminal activity because they control a proportionately larger share 
of the Nation’s financial assets, and because there are likely to be more access 
points to a longer personal history that can be tapped into and exploited. For those 
near or in retirement, the costs of identity theft under any guise are particularly 
high, bringing a sense of violation and a loss of individual security that cannot eas- 
ily be recovered. 

The magnitude of the Nation’s problem with identity theft is just now coming to 
light. Identity theft has been listed by the U.S. Federal Trade Commission (FTC) 
as the fastest growing form of crime in the Nation. Depending on the reporting 
source and the manner in which the information was collected, the estimates range 
from 500,000 to 1.1 million victims for the year 2001 alone. Even the lower estimate 
seems staggering. 

Estimates also vary as to the financial losses incurred, and the time and effort 
it takes to reestablish a victim’s proper credit and community standing. For exam- 
ple, according to studies done by the FTC and by the Privacy Rights Clearinghouse, 
the average victim spends about 175 hours and $1,100 in out-of-pocket expenses. 
Once victimized, an individual may never completely recover his or her “good 
name.” The risk of being victimized has been amplified through the availability and 
use of today’s high-tech information resources and tools. 

The Identity Theft and Assumption Deterrence Act of 1998 — known by short-hand 
as the Identity Theft Act — made it a Federal crime to knowingly transfer or use a 
means of identification of another person with the intent to commit, aid or abet any 
unlawful activity under Federal law, or any activity that represents a felony under 
State or local law. Most States have passed similar laws related to identity theft — 
that is, most State laws make identity theft a criminal offense. 

Thousands of impostors have been caught and prosecuted, most often by the U.S. 
Postal Service Inspection Service (which investigates mail fraud) and the U.S. Se- 
cret Service’s Financial Crime Division. Also important are the efforts of State and 
local law enforcement agencies — although all law enforcement resources are being 
heavily taxed by homeland security and antiterrorism responsibilities. Notwith- 
standing these efforts, it appears that identity theft remains a high-profit, low-risk, 
and — until recently at least — a low-penalty crime. 

Identity Theft: The Experienee of Older Complainants 

The Identity Theft and Assumption Deterrence Act of 1998 made the actual theft 
of an individual’s identifying information a specific Federal crime, and authorized 
the creation of the FTC’s Identity Theft Data Clearinghouse and database — which 
has been in existence since 1999. 

The complaint data are based on self-reporting by the complainant either to the 
FTC or to another agency that subsequently forwarded the complaint to the FTC.^ 
Since inception of the database, the FTC has reported major increases in the num- 
ber of telephone calls from consumers to its Clearinghouse hotline. Calls from 
consumers increased from an average of 445 calls per week in the first month the 


2 The question may arise regarding how to appropriately interpret consumer complaints data. 
We take the perspective that consumer complaints can serve as an early-warning function lead- 
ing to increased accountability and safer, more effective, high-quality processes, products, and 
services. 
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hotline was in operation (November 1999), to an average of 3,000 calls per week in 
December 2001. In addition to the toll-free hotline, consumers can file a complaint 
online or by mail. 

In order to get a sense of the vulnerability among those 50 and older to identity 
theft, AARP requested that the FTC prepare two sets of tabulations based on com- 
plaint data gathered through the Identity Theft Data Clearinghouse for the year 
2001. The 2001 data report on 86,168 identity theft complainants, with 72 percent 
of these (61,956 complainants) reporting age information. 

For the year 2001, more than three-quarters (78 percent) of complainants who 
reported their age (n=61,956) were under 50 years old, while 22 percent of complain- 
ants were 50 years of age or older. We then asked the FTC to ^oup its data for 
complainants on identity theft crimes, for those that provided their ages, into their 
classification system for different types of fraud. 

Key Results 
Credit Card Fraud 

Among the general types of fraud identified by the FTC, 42 percent of all com- 
plainants reported having their stolen information used in an effort to commit credit 
card fraud. Of complainants reporting this type of fraud, 62 percent reported that 
their information was used in an attempt to establish new credit, while 24 percent 
reported their information was used in an effort to access existing credit accounts. 
Half (51 percent) of complainants age 50 and older reported having their stolen in- 
formation used in an attempt to commit credit card fraud. Of complainants report- 
ing attempts at this type of fraud, two-thirds (66 percent) reported their information 
had been used in an effort to establish new credit, while one-third (33 percent) re- 
ported their information was used in an attempt to access existing credit accounts. 

Telephone or Utilities Fraud 

Twenty percent of all complainants reported having their stolen information used 
in an effort to commit telephone and utilities fraud. Nearly half (48 percent) of com- 
plainants experiencing this type attempt at fraud reported their information had 
been used in an effort to establish new wireless telephone service. Seventeen percent 
of complainants age 50 and older reported having their stolen information used in 
an effort to commit telephone and utilities fraud. Almost two-thirds (64 percent) of 
complainants in this age group experiencing this type of attempt at fraud reported 
their information had been used in an effort to establish new wireless telephone 
service. 

Bank Fraud 

Thirteen percent of all complainants reported having their stolen information 
used in an effort to commit bank fraud. Nearly half (47 percent) of complainants 
experiencing this type of attempted fraud reported their information had been used 
in an effort to commit check fraud. Eleven percent of complainants age 50 and older 
reported having their stolen information used in an effort to commit bank fraud. 
Sixty-three percent of older complainants experiencing this type of attempt at fraud 
reported their information had been used in an effort to commit check fraud. 

Loan Fraud 

Six percent of all complainants reported having their stolen information used in 
an effort to commit loan fraud. Half (53 percent) of complainants experiencing this 
type of attempted fraud reported their information had been used in an effort to se- 
cure a personal or business loan. Seven percent of complainants age 50 and older 
reported having their stolen information used in an effort to commit loan fraud. Of 
complainants experiencing this type of attempt at loan fraud, 56 percent reported 
their information had been used in an effort to secure a personal or business loan. 

Overall, 10 percent of all complainants that reported their personal information 
had been stolen indicated that it was used in an attempt to commit some type of 
fraud. However, nearly double that proportion, 18 percent of complainants age 50 
and older, reported attempted identity theft fraud. We believe further collection and 
analysis of complaint data are necessary to better understand the nature of identity 
theft crimes and to devise more effective prevention and enforcement policies. 

Implications for the Fair Credit Reporting Act 

The Fair Credit Reporting Act (FCRA), enacted in 1970, is the foundation of our 
national credit system, consumer reporting agencies (CRA’s) collect and compile in- 
formation on consumers’ creditworthiness from financial institutions, public records, 
and other sources. FCRA applies to the personal credit records maintained by 
CRA’s. The FCRA also outlines a consumer’s rights in relation to his or her credit 
report, as well as permissible uses for credit reports and disclosure requirements. 
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In 1996, the FCRA was amended and now contains seven specific Federal preemp- 
tions (due to sunset on January 1, 2004, unless Congress extends them) that pre- 
vent States from overriding or changing: 

• The responsibilities of organizations and businesses that furnish information to 
reporting agencies. 

• The duties of organizations and businesses to notify consumers when they have 
been denied credit or employment based on information in their credit reports. 

• Procedures that a consumer reporting agency must use if a consumer disputes the 
accuracy of information. 

• The information that may be included in consumer reports, including the time 
during which consumer reporting agencies are permitted to report adverse data. 

• The form or content of the summary of rights that a consumer reporting agency 
is required to provide to a consumer along with information in the consumer’s file. 

• The exchange of information among affiliated institutions. 

• Prescreening procedures that provide consumers with credit or other financial 
services or product lines. 

The consumer credit reporting industry is a $6 billion industry that provides 
information about consumers to a wide variety of businesses. Information on con- 
sumers is purchased by lenders, credit sellers, insurance companies, and landlords, 
and by employers seeking information on prospective or current employees. The 
largest sources of credit reports are the three national consumer reporting agencies 
(CRA’s) that collectively maintain an estimated 570 million files on U.S. consumers. 
Each CRA collects its own data on an individual consumer and maintains its own 
file on that consumer. It should come as no surprise that the credit reporting indus- 
try is the most extensive user of consumer data in the private sector. 

In addition to selling credit reports, CRA’s sell prescreened lists of consumers to 
providers of credit and insurance products. Prescreening involves CRA’s creating a 
list of consumers who meet criteria specified by purchasers of the list. For example, 
credit card companies use prescreened lists to identify and solicit consumers who 
qualify for “preapproved” offers of their credit card product. 

As a result of the large amounts of data involved, the credit reporting industry 
relies heavily on computer automation, and information is transferred, sorted, 
stored, and retrieved electronically. To facilitate this automation, many creditors 
and other furnishers of information to CRA’s use a standardized computer program 
to report data to CRA’s. Information provided to CRA’s is usually received monthly 
and downloaded into their databases. 

The widespread use of credit reports for an increasing variety of purposes, and 
the large amount of information processed by CRA’s, raise a number of issues re- 
garding the FCRA’s uses and effects. One of the major goals of the FCRA is to pro- 
mote accuracy in credit reporting by requiring CRA’s to use reasonable procedures. 
Despite FCRA protections, available data suggest that assuring the accuracy of the 
information in credit reports continues to be a concern. Incorrect information has 
too often been included in consumer credit reports.® 

Another accuracy issue is that information creditors provide to CRA’s may be in- 
complete and positive information may be missing. The FCRA does not require 
creditors to report account payment information to any CRA. Rather, creditors are 
free to report to none, one, two, or all three of the national CRA’s. 

Additionally, some companies apparently intentionally withhold positive credit in- 
formation to prevent the loss of customers to competitors. As a result, the credit re- 
ports of these consumers will not reflect positive payment history, and the consumer 
will be unable to access less costly products and services. 

Inaccuracies can also occur when a creditor sells a delinquent account to a debt 
collector. Once the original creditor sells the account to a debt collector, the debt 
collector becomes the furnisher of information on this account to the CRA’s. The 
main source of inaccuracy in this case results from incorrect reporting of the date 
of initial delinquency on the account."^ 


2000 study examining consumer credit reports found that over half of the credit reports 
examined contained errors. A 1998 study found that 70 percent of credit reports investigated 
contained incorrect information. Of these reports, 29 percent contained errors significant enough 
to have serious adverse consequences for the consumer’s credit, and 41 percent contained per- 
sonal identifying information that was either incorrect or obsolete. See Appendix 2. 

’^One concern is that debt collectors may report the date they purchased or received the 
account as the date of initial delinquency, even though the actual date of initial delinquency 
was likely much earlier. Because the FCRA stipulates that most negative information remains 
on a consumer credit report for 7 years from the date of initial delinquency, establishing this 
date is important to consumers attempting to restore their credit. 
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A further source of inaccurate information is error in the electronic merging of 
files that occurs when one consumer’s credit information is mixed with another con- 
sumer’s file. This typically occurs with consumers who have similar identif 3 dng 
information such as a similar name or Social Security number. 

Yet another source of inaccuracy occurs when CRA subscribers request informa- 
tion on one consumer from a CRA database, and obtain data on another consumer 
instead. This problem occurs because the accuracy of the information received from 
a CRA is inversely related to the specificity of the identifying data elements that 
are used to search the database. That is, subscribers who use fewer identifying ele- 
ments are more likely to receive credit information unrelated to the consumer about 
whom they are seeking credit information. For example, a subscriber who uses only 
name and address information will likely receive more matches (and consequently 
less accurate information) than a subscriber who uses additional identifiers (such 
as Social Security number and date of birth). 

Consumers are typically required to pay a fee when obtaining a copy of their 
credit report. The FCRA allows CRA’s to charge consumers a fee of up to $9 (plus 
applicable State tax) for a copy of their credit report. Six States entitle consumers 
to one free credit report from each CRA annually, while other States cap the cost 
of credit reports below the Federally mandated level. 

Because most consumers have separate files at all three national CRA’s, con- 
sumers are well-advised to purchase their credit report from all of them to ensure 
that each of their credit reports are accurate. They are used by potential lenders 
to provide an instant summary of information contained in the consumer’s credit 
report and may be used to rank consumers to determine whether they qualify for 
a loan, how much they should be lent, and at what rate. 

Then there is the problem of identity theft that I raised earlier. At issue here is 
the role of the FCRA in preventing identity theft and assisting victims of this crime. 
Previously, I noted that older persons can be an appealing target for such theft 
because they typically have significant available credit to draw on. They can also 
be victimized by family members or caregivers who have access to their personal 
information. It appears that all too often, the identity thief takes the individual’s 
personal information and uses it to open fraudulent accounts based on the unknow- 
ing victim’s credit report information. 

FTC complaint data show that consumers often experience substantial difficulty 
in correcting information they dispute. One concern is that reinvestigation proce- 
dures used by CRA’s are inadequate. Another problem is the reappearance of incor- 
rect information previously deleted from a consumer’s credit report. In addition, 
victims of identity theft have reported difficulty in removing fraudulent items from 
their credit reports even after the identity theft has been discovered. 

Another FCRA issue involves the preemption of some aspects of existing State 
credit reporting laws. Most States have laws relating to credit reporting, and gen- 
erally the FCRA does not preempt State laws that provide greater consumer protec- 
tions. Should the State preemptions expire on January 1, 2004, as required under 
the FCRA, States would be allowed to enact legislation governing the sharing of 
such information. 

Our survey of issues concludes with the 2-year statute of limitations provided by 
the FCRA. This issue is the result of a 2001 Supreme Court decision involving an 
identity theft victim’s suit against a CRA for failing to take reasonable steps to en- 
sure the CRA was issuing a credit report for the right person. The Court’s ruling 
is a major concern for identity theft victims and their counsels because it takes an 
average of 14 months for victims to learn of the theft and subsequent damage to 
their credit reports. As a result, consumers who do not learn of problems in their 
credit reports quickly enough may have no legal recourse. 

Some Recommendations 

To address these concerns, we recommend that Congress and the Administration: 

• Provide stronger enforcement of rules requiring the date of initial delinquency to 
be reported correctly by debt collectors. The FCRA requires furnishers of such in- 
formation to verify the accuracy of the data reported when challenged by a con- 
sumer. This proposal is intended to prevent the reporting of negative information 
beyond the time limits provided by the FCRA. 

• Require subscribers who purchase credit reports from CRA’s to provide the same 
standard of identification to retrieve a consumer’s credit report as is required of 
consumers seeking their own credit report. Because CRA’s have procedures in 
place for consumer access, these same procedures can be applied to subscribers 
requesting credit reports. 

• Require CRA’s to provide consumers with at least one annual free credit report 
a year to make it easier and less expensive for consumers to monitor their credit 
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reports. Prohibitions need to be enacted that protect consumers from fraudulent 
“credit-repair” practitioners. 

• Allow consumers to place a security freeze on their credit report, and issue to con- 
sumers a password to prevent their credit report from being accessed without 
their express authorization. California recently enacted such a provision. This pro- 
cedure slows down the process for retrieving a consumer’s credit report because 
the consumer must first contact the CRA’s and give permission for the release of 
his or her credit report to the specified individual or business, thereby providing 
an extra check to prevent fraud. 

• Require CRA’s to permanently block fraudulent accounts on the credit reports of 
identity theft victims. Such blocking is required under California law and has 
been proposed under Federal legislation. This requires CRA’s to correctly identify 
that the account is fraudulent despite the fact that the account may have been 
sold to a debt collector and been reported as a separate account. 

• Require the FTC to monitor how effectively consumer disputes with CRA’s are 
resolved. 

• Allow the Federal preemptions to expire as originally intended under the FCRA 
unless Federal legislation providing greater consumer protections can be enacted. 

• Change the statute of limitations to allow consumers more time to discover poten- 
tial problems in their credit reports. Federal legislation has been proposed to ex- 
tend the statute of limitations. Changing it to 2 years from the time the violation 
is discovered, or should have been discovered by the exercise of due diligence by 
the consumer, would give consumers a longer time frame in which to act. 

Conclusion 

AARP supports strengthened Federal, State, and local efforts to hold the perpetra- 
tors of identity theft and fraud accountable. We are prepared to work with you. 
Chairman Shelby, Senator Sarbanes, and with the other Members of this Com- 
mittee in this regard. However, we also believe that efforts to improve account- 
ability should be complemented with effective measures to provide victim assistance. 

And we believe that the practices of credit reporting agencies should be reformed 
to protect consumers and businesses against erroneous information, provide greater 
consumer access to credit files, enable consumers to correct erroneous information 
more easily, require that credit reports be more user-friendly, and require the purg- 
ing of files after a reasonable time. We would be very happy to work with the Com- 
mittee in updating and upgrading the FCRA. 

I would be pleased to answer any questions that you may have. 
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APPEHDIX 1 


PUBLIC POLICY INSTITUTE 


IDENTITY THEFT: EXPERIENCE OF OLDER COMPLAINANTS 


INTRODUCTION 

Identity theft occurs when an individual’s 
personal identifying mfonnation (for example, 
name, Social Security number, date of With, w 
mother’s maiden name) is stolen by another 
person and used to commit fraud or engage in 
other unlawful activities.^ Oftoi, this stol«i 
infomuttion is used to establish credit, run up 
debt, or take over existing financial accotints. As 
a result, identity theft is referred to as an 
enabling crime since it permits criminals to 
• commit other crimes, such as credit card ot bank 
fraud.2 

Typically, identity theft damages the victim’s 
credit, making it difficult for the victim to buy a 
home or car, rent an apartment, obtain 
employment, or purchase insurance. Victims 
of^ spend substantial amounts of time and 
money resol\dng problems created by identify 
theft. Common problems include the victim’s 
having to contact credit bureaus repeatedly in an 
attempt to clear his or her credit reports of 
fraudulent accounts, being turned down for 
credit based on the incorrect information 
contained in the victim’s credit report, and 
receiving calls from creditors seeing to collect 
on the fraudulent accounts. In addition, victims 
often suffer a psychological impact as a result of 
the crimc.3 

The Identity Theft and Assumption Deterrence 
Act of 1998 made the actual theft of an 
individual’s identifying information a specific 
federal crime. The Act also created the Identify 
Theft Data Clearinghouse database, which is run 


^ U.S. Gmeral Accounting Office (GAO). Identity 
Th^: Prevalence and Cost Appear to be Growing 
(March 2002). 

2 Testimony of James G. Huse, Jr. (Inspector General 
of the Social Security Administration), before the 
U.S. Senate Special Cominittee on Aging (July 18, 
2002 ). 

^ U.S. GenCTSl i^counting Office (GAO) (March 
2002), op. cit 


by the Federal Trade Commission (FTC),'* and 
provides for victim assistance and consumer 
education. In addition, 44 states have passed 
laws similar to the Idmtify Theft and 
Assumption Deterrence AcL^ 

The U.S. Department of Justice considers 
identify theft to be one of the nation’s fastest- 
growing crimes.® While prevalence data have 
been difficult to obtain,’ a recent report by the 
U.S. General Accounting Office (GAO) suggests 
that identify theft crimes seem to be increasing, 
based on data from the FTC Qeaiinghouse 
database, the Social Security Administration, 
federal law enforcement agencies, and credit 
bureaus.^ Identify theft was the leading 
consumer fraud conyrlaint received by the FTC 
in 2(X)1, representing 42 percent of cemsumer 
fraud complaints, while the next most common 
conqilaiDt (Internet auctions) accounted for only 
10 percent of consumer fraud complaints.’ 

The FTC’s Identify Theft Data Clearinghouse 
database has been in existence since 1999. Since 
inception of the database, the FTC has reported 


* This database is available to local, state, and federal 
law enforcement agencies tbrougb an encrypted web 
site. 

® U.S. General Accounting Office (GAO). Identity 
Th^: Greater Awareness and Use qf Existing Data 
Are Needed (June 2002). 

® Statnnent of John Ashcroft (Attorney General, U.S. 
Department of Justice) at Identity Iheft Press 
Conference (May 2, 2002). 

’ Identity theft as a crime is not specifically recorded 
as an offense category by the FBI's Uniform Crime 
Reporting Program. ‘Ihis program involves cify, 
counQ', and state law enforcement ^encies 
voluntarily reporting crime data from their 
jurisdictioD. 

* U.S. General Accounting Office (GAO) (March 
2002), op. cit 

’ Federal Trade Commission (FTC) press release. 
Identity Thefi Heads the FTC's Top 10 Consumer 
Fraud Complaints of 2001 (January 23, 2002). The 
FTC received 204,000 consumer fraud complaints in 
2001. 


AARP PPI Data Digest Nuiuber 85 


196 


major increases in the number of telephone calls 
from consumers to its Clearinghouse hotline. 
Calls from consumers have increased from an 
average of 445 calls per week in the first month 
the hotline was in operation (November 1999), 
to an average of 3,000 calls per week in 
December 2001.^® In addition to the toll-free 
hotline, consumers can file a con^laint online or 
by mail. 

METHODOLOGY 



This data digest presents the results of special 
tabulations by the FTC for the AARP Public 
Policy Institute of 2001 complaint data gathered 
through the Identity Theft Data Clearinghouse.^^ 
. The complaint data are based on self-reporting 
by the complainant either to the FTC or to 
another agency that subsequently forwarded the 
complaint to the FTC.*^ The 2001 data report on 
86,168 identity theft complainants, with 72 
percent of these (61,956 complainants) reporting 
age information. The complaint data are used to 
create two groups: all complainants (86,168 
complainants) and complainants 50 years of age 
and older (13,696 complainants). 

FINDINGS 

Age Distribution of Complainants 

More than three-quarters (78%) of complainants 
who reported their age were less than 50 years 
old, while 22 percent of complainants were 50 
years of age or older (Figure 1). 


U.S. General Accounting Office (GAO) (March 
2002), op cit 

1 ^ Access to Clearinghouse data is restricted to FTC 
staff and law enforcement agencies. The FTC report 
is entitled, "Identity Th^ Victim Complaint Data: 
Figures and Trends on Identity Th^ for AARP 
January 1 — December 31, 2001." 

For example, the Social Security Administration 
forwarded 15,611 complaints to the FTC 
Clearinghouse in 2001. 


Types of Identity Theft Fraud 

The FTC groups identity dieft crimes into a 
number of different fraud types. Table 1 lists the 
general fraud types identifi^ by the FTC and 
ffie total number of complaints received from all 
complainants in 2001. 


Tablet: 

Types of Identity Theft 

Reported to The FTC in 2001 

Theft Types 

All Complainants 

Number of 
Complaints 

Percent of All 
Complainants* 

Credit Card Fraud 
Rh^v\)tildes Fraud 

36.020 

17,294 

41.8% 

20 

Bartk Fraud 

Empioyment-Related v 

.Fraud.';{'iS;- : - 

Loan Fraud 

brournenta^^^Hi' % 

Other Identity Theft 

Fraud 

Atterripled identity Theft 
.Fraud 

11.268 

5.595 

4 "6309 

' ■ -V' 

16,095 

13.1% 

89% 

6.5% 

: 

18.7% 

9.5% ' 

Number of 
Complainants 

ne 86,168 

‘Total percentages exceed 100 because some complainants 
reported the occurrence of more than orte type of fraud. 


Credit Card Fraud 
All Complainants 

Forty-two percent of all complainants reported 
having their stolen information used to commit 
credit card fraud. Of complainants reporting this 
type of fraud, 62 percent reported diat their 
information was used to establish new credit, 
while 24 percent reported their information was 
used to access existing credit accounts (Figure 2). 
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Complainants Age 50 and Olckr 
Half of complamants (51%) age 50 and older 
reported having their stolen information used to 
commit credit card fraud. Of complainants 
reporting this type of fraud, two-diirds (66%) 
reported their infornmtion had been used to 
establish new credit, while one-third (33%) 
reported their information was u^ to acce^ 
existing credit accounts (Figure 2). 


Figure 2: 

Credit Card Fraud, by 



AARP Public Policy Institute 


Telephone and U61itie.s Fraud 
All Complainants 

Twenty percent of all complamants reported 
having their stolen information used to commit 
telephone and utilities fraud. Nearly half (48%) 
of cotr^lainants eiq>eriencing this type of fraud 
r^rted their information been used to 
establish new wireless telephone service. 

Complainants Age 50 and Older 
Sev^een percent of complainants age 50 and 
older reported having their stolen information 
used to commit telephone and utilities fr^ud. 
Almost two-thinte (64%) of complainants 
experiencing this type of fraud reported their 
information had beoi used to establish new 
wireleK telq)hone service. 

Bank Fraud 
All Complainants 

Thirteen percent of all complainants reported 
having their stolen information used to commit 
bank fraud. Nearly half (47%) of complainants 
experiencing this type of fraud report^ their 
information had be^ used to commit check 
fraud. 


Complainants Age 50 and Older 
Elevai percent of coixq)lamante age 50 and older 
rcpoitai having their stolen information ised to 
commit bank fraud. Sixty-three percent of 
complainants experi^cii^ this type of fraud 
reported their information had been used to 
commit check fraud. 

Loan Fraud 
All Complainants 

Six percent of all complainants reported having 
frieir stolen information used to commit loan 
fraud. Half (53%) of MH^lainants experiencing 
this type of fraud reported their information had 
been used to secure a personal or business loan. 

Complainants Age SO and Older 
Seven percent of complainants age 50 and older 
reported having their stolen information used to 
commit loan fraud. Of complainants 
experiencing loan fraud, 56 percent reported 
their information had been used to secure a 
personal or business loan. 

Attempted Identity Theft Fraud 
All Complainants 

Ten percent of all complainants r^)oited their 
personal information had been stolen and used in 
an attempt to commit fraud. While the 
complainant’s identifying information was 
stolen successfully, the thief was unsuccessful in 
his or her atten^ts to use the information to 
commit fi^ud (Figure 3). 

Complainants Age SO and Older 
Eighteen percent of complainants age 50 and 
older reported attempted identity theft fraud 
Persons in friis age group rqjort^ this crime at 
almost twice the rate of the all-complainants 
group (Figure 3). t 
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Figure 3; 

Attempted Identity Theft Fraud 



Table 2: Top States for 50+ Identity Theft 

States 

Age 50+ Complainants per Capita 

District of 
ColumNa 

CaOfomB 

Nevetia 

New York 

Flonda 

Waslungton 

Oregon 

Maryland 

An zona 

43 

. 31 

28 

27 

26 

25 

, * " '’24 77 

24 


Identity Theft in the States 

Based on 2001 FTC complaint data and 2000 
Census data, per c^ita rates^^ of identity theft 
can be calculated for complainants age SO and 
older by state (and the District of Columbia). 
Figure 4 illustrates the per capita rates of 
identity theft for the 50-plus peculation of each 
state. 


Figure 4: 

States by Age 50+ Identity Theft 
Complainants per Capita 



by SO^Complaiiwili p*r CapHa 

■ 20 . 6 to 42 .e 

■ 13.6to20.B 

□ 9.7 to 13.6 

□ 4.6 to 9.7 


AARP Public Policy Institute 


Table 2 lists the states with the highest per 
capita rates of identity theft for complainants 
who are age 50 and older. 


Per capita rates are calculated per 100,000 persons 
50 years of age or older in each state (and the District 
of Columbia) based on 2000 U.S. Census population 
estimates. 


SUMMARY 

Analysis of 2001 FTC complaint data indicates 
that complainants age 50 and older were more 
likely to report a number of different identity 
theft crimes than the all-complainants group. 
These crimes include: 

• Fraudulently using a complainant’s existing 
credit card account 

• Fraudulently establishing a new credit card 
account in the complainant’s name 

• Fraudulently opening a wireless account in 
the complainant’s name 

• Fraudulently using a complainant’s 
information to commit check fraud 

• Fraudulently taking out a personal or 
business loan in the complainant’s name 

• Stealing a complainant’s identifying 
information and using it in unsuccessful 
attempts to commit fraud 

The number of identity theft crimes appears to 
be rapidly growing. Further collection and 
analysis of complaint data are necessary to better 
understand the nature of identity theft crimes 
and to devise effective prevention and 
enforcement policies. 


Writtcaility Neal Walters md Ann McLanjJaiksofl ^ 
AARP^bUic Policy InJititole, March 2003 
601 ESireetRW, Washington, DC 20049 
©2003 AARP 

Reprinting with penniaiian only. ^ ^ ^ 
http://aww.aan> ontfbm „ 
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THE FAIR CREDIT REPORTING ACT: ISSUES AND POLICY OPTIONS 


Introduction 

The Fair Credit Reporting Act (FCRA) is a 
federal statute‘ designed to promote accuracy and 
fairness in credit reporting by regulating the 
activities of Consumer Reporting Agencies 
(CRAs),^ those who furnish information to 
CRAs, and those who use consumer reports.^ 

A consumer report is defined by the FCRA as 
any written, oral, or other communication by a 
CRA bearing on a consumer’s creditworthiness, 
credit standing, credit capacity, character, general 
-reputation, personal charactmstics, or mode of 
living.* 

These consumer reports, often called credit 
reports,' can be issued to any eligible subscriber 
of a CRA for the purpose of establishing a 
consumer’s eligibility for credit, insurance, rental 
housing, and employment.* However, 
infbnnation contained in credit reports is 
increasingly being used to determine more than 
whether a consumer meets certain eligibility 
qualifications. Credit report information is also 
being used to determine the pricing of the credit 
or insurance as well as how much credit will be 
given and under what terms. 

For example, Table I lists the pricing structure 
used by one l^der for automobile purchase loans 
based on the consumer’s level of 
creditworthiness as measured by his or her credit 
report 


* A credit report consists of four types of information. 
Fust, the report lists identifying formation, such as 
name, last reported address, mariul status. Social 
Security number, date of bir&, spouse’s name, number 
of dependents, previous address, and enq)loyment 
infarmation. Second, the report lists the consumer’s 
credit infonnatioa, including credit account numbers, 
creditor's name, amount of last payment, credit limit, 
and credit payment history of each account. Third, any 
public record information, such as tax liens, court 
judgments, and bankruptcies, is listed. Last, the report 
notes inquiries and the names of any creditors diet 
have reviewed a copy of the consuma''8 credit report 



The FCRA seeks to prevent dissemination of 
incorrect, deceptive, or obsolete information 
about a consumer while also protecting the 
privacy of consumers by preventing disclosure of 
credit reports to unauthorized persems or entities. 
In addition, the FCRA allows consumers to 
access their files held by CRAs and to amend 
inaccurate infonnation contained in these files. 

This Issue Brief provides background on the 
credit reporting industry and describes the role of 
the FCRA in regulating the consumer credit 
reporting indusiiy. It also discusses a variety of 
issues associated with the FCRA and potential 
policy options to address these issues. 

Background 


The FCRA took effect on April 25, 1971, and 
was substantially amended on September 30, 

] 996. The 1 996 amendments were primarily the 
result of continuing concerns about inaccuracies 
in credit rqjorts and problems reported by 
consumers seeking to correct such inaccuracies.^ 
The major changes to Uie FCRA included the 
in^osition of a 30-day deadline (with a 
conditional 15-day extension) for CRAs to 
reinvestigate infonnation disputed by a 
consumer,’ the inclusion of protections against 
the reinsertion of information that had been 
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removed,® and the establishment of standards of 
accuracy for fumishera of infmnraticm to the 
CRAs.^ 

The Consumer Credit Reporting Industry 

The consumer credit reporting industry is a $6 
billion industry drat provides information about 
consumers to a wide variety of businesses. 
Informaticm on consumers is purchased by 
lender^ credit sellers, insurance (rompanies, and 
landlords, and by employers seeking information 
on prospective or current employees. Credit 
information is widely used, and more than me 
billion credit reports are sold each year in the 
United States. One industry source notes that, 
on average, a consumer’s credit is checked 
anywhere from five to 10 times a month.*' 

The largest source of credit reports are the three 
national CRAs*^ that collectively maintain 
approximately 570 million files on U.S. 
consumers.*^ Because the CRAs are competitors, 
each collects its own data on an individual 
mnsumer and maintains its own file on that 
consumer. As a result, the contents of a 
consumer’s file will likely vary among the three 
bureaus.*^ 

In addition to selling credit reports, CRAs sell 
prescreened lists to providers of credit and 
insurance products. Prescreening involves CRAs’ 
creating a list of consumers who meet criteria 
specified by purchasers of the list. For exan^le, 
credit card companies use prescreened lists to 
identify and solicit consumers who qualify for 
"pre-approved” offers of their credit card 
product. According to industry sources, 3.5 
billion prescreened offers were made in 2000 
b^d on prescreening lists created by CRAs.*^ 
The FCRA allows consumers to opt out of such 
offers.** 

The credit reporting industry is the most 
extmsive user of consumer data in the private 
sector. According to industry sources, the 
average consumer report contains 1 1 accounts 
(seven credit trard ^counts and four loan 
account), each of which is updated regularly. 
As a result of the large amounts of data involved, 
the credit reporting industry relies hravily on 
computer automation, and information is 


transferred, sorted, stored, and retrieved 
electronically. The use of computer technology 
enables CRAs to receive information from a 
number of sources and to capture data on 
consumers throughout the United States.*® 

To facilitate this automation, many creditors and 
other furnishers of inforroati(m to CRAs use a 
standardized computer program to report data to 
CRAs.*’ Information provided to CRAs is usually 
received monthly and download^ into their 
databases. New information often supersedes 
earlier information provided by the same creditor 
in the last download.^ CRAs are unlikely to 
depart from the automated systems since such a 
move would reduce the speed and efficiency of 
the database and increase co^?* 

FCRA Issues 

The widespread use of credit reports for an 
increasing variety of purposes, and file kr]^ 
amount of information processed by CRAs, 
raises a number of issues regarding the FCRA’s 
effectiveness. 

Accuracy 

One of the major goals of the FCRA is to 
promote accuracy in credit reporting by requiring 
CRAs to use reasonable procedures.^ De^te 
FCRA protections, available data indicate that 
assuring the accuracy of the information in credit 
reports continues to be an issue. 

Incorrect information is often included in 
consumer credit rqjorts. According to a 1993 
report based on Federal Trade Commission 
(FTC) complaint data, the most common type of 
consumer complaint received was related to 
credit reports, with the majority of the complaints 
having to do with accuracy.^^ Despite the 1 996 
amendments, the FTC not^ in 2(X)2 that 
complaints about credit reports are still one of the 
most common cemsumer complaints the a^icy 
receives, wifii the largest number of complaints 
still relating to accuracy.^ 

A 2000 study examining consumer credit reports 
found that over half of the credit reports 
examined contained errora.^* A 1998 stiKiy found 
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that 70 percent of credit reports investigated 
contained incorrect information.^*^ Of these 
reports, 29 percent contained errors significant 
enough to have serious adverse consequences for 
the consumer’s credit, and 41 percent contained 
personal identifying information that was either 
incorrect or obsolete. In contrast, an unpublished 
1 992 study sponsored by industry sources found 
that less than 1 percent of credit reports contained 
errors significant enough to result in a ccmsumer 
being d^iied credit.^ 

Another accuracy issue is dial information 
creditors provide to CRAs may be incomplete 
and positive information may be missing.^* The 
FCRA does not require creditors to r^ort 
account payment information to any CRA. 
Instead, creditors are fi^e to report to none, one, 
two, or all three of the national CRAs. Variations 
in information contained in credit reports based 
on which CRA the credit report was drawn from 
can result in wide variances in the apparent 
creditworthiness of a consumer.^’ 

Additionally, some companies intentionally 
withhold positive credit information to prevent 
the loss of customers to competitors.^ This 
practice is particularly common in the subprime 
lending market, where consumers pay higher fees 
for access to credit.^ ^ As a result, the credit 
repoi^ of these consumers will not reflect 
positive payment history, and the consumer will 
be unable to access less costly products and 
services. The Comptroller of the Currency 
recently suggested that corrective legislation may 
be necessary to require reporting of credit 
information to CRAs to protect consumers from 
such practices.^^ 

Inaccurawiies can also occur when a creditor sells 
a delinquent accoimt to a debt collector. Once the 
original creditor sells the account to a debt 
collector, frie debt collector becomes the 
furnisher of information on this account to the 
CRAs. The main source of iiwccuracy in this 
case faults from incorrect reporting of the date 
of initial delinquency on the account. One 
concern is that debt coUectore nmy report the date 
they purchased or received the account as the 
date of initial delinquency, even though the 
actual date of initial delinquency was likely much 
earlier. Because the FCRA stipulates that most 


negative information remains on a consumer 
credit report for seven years from the date of 
initial delinquency,^ establishing this date is 
important to consumers attempting to restore 
their credit. 

A further source of inaccurate information is the 
mismerging of files that occurc when c®e 
consumer’s credit information is mixed with 
another consumer’s file. Mismerged file cases 
occur when CRA computers do not match 
consumer data to the correct consumer as 
incoming data are sorted. This typically occurs 
with consumers who have similar identifying 
information such as a similar name or Social 
Security number. 

In one recent example, a consumer found that 
negative information pertaining to another 
consumer with the same first name and similar 
Social Security number was repeatedly placed on 
her credit report.^^ Despite the consumers’ having 
different dates of birth, differ^t last names, and 
different addresses, the computer matching 
system routinely mismerged these files.^ 

Another potential source of inaccuracy occurs 
when CRA subscribers request information on 
one consumer from a CRA database, and obtain 
data on another consumer instead. This problem 
occurs because the accuracy of the infoimation 
received from a CRA is inversely related to the 
specificity of the identifying information used to 
search the database.^’ As a result, subscribes 
who use less identifying information are more 
likely to receive credit information unrelated to 
the consumer abcnit whom they are se^dng credit 
information. 

For example, a subscriber who uses only name 
and address information will likely receive more 
matches (and cwisequently less accurate 
information) than a subscriber who uses 
additional identifiers (such as Social Security 
number and date of birth). While the CRAs 
require very specific identifying information 
from consumers requesting their own files, this 
standard does not apply to paying subscribera.^® 
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Consumer Cost 

Consumers are typically required to pay a fee to 
obtain a copy of Aeir credit report.^’ The FCRA 
allows CRAs to chaise consumers a fee of up to 
S9 (plus applicable state tax) for a copy of their 
credit report.^ Six states entitle consumers to free 
credit reporte annually, while other st^es C£q> the 
cost of credit reports below the federally 
mandated level (Table 2). 


Table 2 

Cost to Consumer fw Credit Report 
Disclosure 


STATE 

FEE* 

Colorado, Georgia, 
Maryland, 
Massachusetts, New 
Jersev. Veraiont 

Free Annual Report 
(2 per year in 
Georgia) 

Maine, Minnesota 

$3.00 

Connecticut 

$5.00 

California 

S8.00 

Montana 

$8.50 

All Other States 

$9.00 


Source: Equifax fwww.eautfax.com) Retrieved January 
16, 2003. 

* Fees do not include sqiplicable state taxes 


AARP Public Policy Institute 


Because most consumers have separate files at all 
three national CRAs, consumers need to purchase 
their credit report from all of them to ensure that 
their credit reports are accurate. In addition, if 
consumers want to see their credit score,* they 
may required to pay an additional fee for this 
disclosure.^’ 

For consumers s^king to monitor their credit 
regularly, some of the CRAs offer credit- 
monitoring services that allow frequent access to 
the consumer’s credit report and notification of 
any significant changes to that credit report (for 
example, a new account opened or negative 


* Credit scores are numbers calculated to measure the 
risk of delinquency or default posed by a consumer 

seeking credit. They are used by potential lenders to 
provide an instant summary of information contained 
in the ccmsumer’s credit report and to rank consumers 
to determine wh^er a consumer qualifies for a loan, 
how much the consumer will be lent, and at what rate. 


information reported). However, these services 
retpiire acce^ to a computer ^d may not be 
affordable to all consumers.^^ 

Identity Theft 

An issue that has received a great deal of 
discussion recently is the role of the FCRA in 
preventing identity theft and assisting victims of 
this crime. Older persons can be an appealing 
target for such thefts because they typically have 
significant available credit to draw on and can be 
victimized by family members or caregivers who 
have access to their |tersonal information.^^ 

Often, the identity theft results in an individual’s 
pereonal information being used to open 
fraudulent accounts based on the imbiowing 
victim’s credit report information. 

Some consumer groups argue that CRAs make 
identity theft easier by furnishing consumer 
credit reports to subscribers based on identifying 
information that is less comprehensive tiian that 
demanded of consumers seeking their own 
reports.'” Also, consumer groups sugg^t that 
CRAs could help to reduce idratity theft by 
focusing on the appearance of non-matching 
address informatiem in a credit report, because 
this non-matching address is a major indicator of 
possible identity theft.^^ 

Victims often report difficulty in preventing their 
credit reports from continuing to be used to 
obtain fraudulent accotmts after the identity theft 
has been discovered.^ To remedy this situation, 
CRAs have developed a standardized security 
alert notification system designed to notify any 
subscribers requesting a consumer’s credit report 
that fraudulent activi^ has been reported.'*’ 
Despite this, one study found that almost half of 
identity theft victims (46%) reported the 
reoccurrence of financial fraud after they l:md 
notified CRAs of the identity theft and placed a 
security alert notification on their credit report.**® 

Dispute Resolution 

FTC complaint <^ta show tiiat consumers 
experience difficulties in correcting information 
they dispute.^’ One concern is that reinvestigation 
procedures used by CRAs are inadequate due to 
quotas in^osed on CRA staff charged with 
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investigating consumer complaints. For example, 
one CRA requires its staff to complete nine 
consumer complaint investigatioiK per hour.^ 

Another issue is the reappearance of incorrect 
information previously deleted from a 
coiKumer’s credit report. This problem is of 
particular concern for victims of identity theft 
attempting to clear their credit reports of 
fraudulent information.^^ Often this is the result 
of a creditor >vi1h uncoixected files sending new 
computer data files that supercede changes made 
previously to a consumer’s credit report by the 
CRA.^^ 

In addition, victims of identity theft have 
reported difficulty in removing fraudulent items 
from their credit report after the identity theft 
has been discovered. Identity theft victims report 
friat this process is time-consuming; it can take 
years to completely remove the incorrect 
information from fte consumer’s credit report.^^ 

FCRA State Preemption 

A key FCRA issue involves the preemption of 
some aspect of existing state credit reporting 
laws.^ Most states have laws relating to credit 
reporting, and generally the FCRA does not 
preempt state laws that provide greater consumer 
protections. However, the FCRA does preempt 
states from enacting more extensive protections 
with regard to the use of credit rqwrts to 
prescreen consumers, the duties of peiaons who 
take adverse action against a consumer based on 
information contained in a credit report, and how 
companies share customer information with their 
corpOTate affiliates.^^ 

Certain state credit reporting laws are exempted 
from these preemptions, provided they were in 
effect before S^ember 30, 1996.^^ This 
exemption includes laws relating to the time by 
which a CRA must take action during a consumer 
dispute, information contained in credit reports, 
and responsibilities of furnishers of information 
to CRAs.^^ In addition, Vermont state law 
reading information-sharing among affiliates is 
exempted.^* 


Preemption of state laws was intended to be a 
temporary measure.^’ Under the FCRA, any state 
law enacted after January 1, 2004, that 
siq)plements the FCRA* and affords greater 
protections to consumers will not be pi^mpt^,^ 

The financial service inAistry is particularly 
concerned about removal of the FCRA federal 
preemption barring all states except Vermont 
from placing requirements on businesses that 
share customer information wifri their corporate 
affiliates.^^ At the same time, consumer 
advocates are seeking to increase consumers’ 
ability to keq) their financial information private. 
Currently, sh^ng data about a customer’s 
account among affiliates is permitted without the 
consumer having an c^portunity to opt out. 
Should the state preemptions expire on January 1, 
2004, as required under the FCRA, states would 
be allowed to enact legislation governing the 
sharing of such information. 

FCRA Statute of Limitations 

An issue that has received much recent attention 
involves the two-year statute of limitations 
provided by the FCRA.*^ This is the result of a 
2001 Supreme Court decision involving an 
identity theft victim’s suit against a CRA for 
failing to take reasonable steps to ensure the 
CRA was issuing a credit report for the right 
person. The court ruled that the two-year statute 
of limitations begins at the time the liability 
occurs rather than from the time of discovery by 
a consumer.^ 

The court’s ruling is a major concern for identity 
theft victims since, according to one study, it 
took an average of 14 months for victims to learn 
of the theft and subsequent damage to their credit 
reports.^ As a result, consumers who do not 
learn of problems in their credit reports quickly 
may have no legal recourse against a CRA. 


* While only the preemption provisions are scheduled 
to expire, some reports have stated incorrectly fiiat the 
enure FCRA will expire January 1, 2004. 
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Policy Options 

A number of policy options have been proposed 

to address the FCRA issues discussed ^ove, 

including: 

• Provide stronger enforcemwit of rules 
requiring the date of initial delinquency to be 
reported correctly by debt collectors. The 
FCRA requires furnishers to verify the 
accuracy of the (hite reported when challenged 
by a consumer.^ This proposal is intended to 
prevent the reporting of negative information 
beyond the time limits provided by the FCRA. 

• Require sut^crib^s who purchase credit 
reports fiom CRAs to provide the same 
standard of identification to retrieve a 
consumer’s credit report as is required of 
consumer seeking their own credit report 
Because CRAs have procedures in place for 
consumer ^ces«, these same procedures can 
be applied to subscribers requesting credit 
reports. 

■ Require CRAs to provide consumers with at 
least one annual See credit report a year to 
make it e^ier and l^s expensive for 
consumers to monitor their credit reports. Six 
states provide for consumers to receive free 
credit reports (see Table 2), and federal 
legislation has been proposed to allow 
consumers in all states to receive at least one 
free annual credit report.^ 

■ Allow consumers to place a security freeze on 
fiieir credit report. Consumers would be issued 
a password to prevent their credit report from 
being access^ wifriout their express 
authorization. California recently enacted such 
a provision.*’ This procedure slows down the 
process for retrieving a consumer’s credit 
report because the consumer must first contact 
the CRAs and give permission for the release 
of his or her credit report to the specified 
individual or business, thereby providing an 
extra check to prevent fraud. 

■ Require CRAs to permanently block fraudulent 
accounts on the credit reports of identity theft 
victims. Such blocking is required under 


California law*® and has been proposed under 
federal legislation.*’ This requires CRAs to 
coirectly identify that the account is fraudulent 
despite the fact that the account may have been 
sold to a debt ^Hector and been re|X)rted as a 
separate account. 

• Require the FTC to monitor how effectively 
consumer disputes with CRAs are resolved. 
The FTC has suggested creating a complaint 
referral system so consumers contacting the 
FTC with a complaint against a CRA could 
have the FTC forward the complaint to the 
CRA for resolution.’® This referral system 
would allow the FTC to analyze patterns of 
complaints and monitor potential problems in 
the processes and procedures used by CRAs to 
resolve disputes.’' 

■ Allow the state preemptioi^ to expire as 
originally intended under the FCRA unless 
federal legislation providing greater consumer 
protections can be enacted. The sunset of state 
preemptions would create an incentive to 
address current gaps in federal privacy 
protections, particularly wifti regard to data- 
sharing among affiliated companies, while 
providing a uniform standard that would limit 
the compliance costs of CRAs and other 
businesses.’^ 

• Change the statute of limitations to allow 
consumers more time to discover potential 
problems in their credit reports. Federal 
legislation has been proposed to extend the 
statute of limitations.’^ Changing it to two 
years from the time the violation is discovered, 
or should have been discovered by the exercise 
of due diligence by the consumer, would give 
consumers a longer time frame to act. 

Summary 

The FCRA provides consumers with important 
safeguards concerning the accinacy and privacy 
of information contained in credit reports. 
However, the widespread and increasingly varied 
use of credit report data, and the dang^ posed to 
both consumers and businesses from the 
emergence and spread of identity crimes, argues 
strongly for updating and strengthening the Act. 
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Further, recent experience indicates diat the 
efFectiven^s of the FCRA can be improved by 
including provisions to increase the accuracy of 
consumer r^orts, improve the dispute resolution 
process, prevent identity theft, and assist the 
victims of such crimes in restoring their credit 
reports. 
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REPONSE TO WRITTEN QUESTION OF SENATOR DOLE 
FROM J. HOWARD BEALES, III 

Q.l. Mr. Beales, while there is always room for improvement, do 
you believe that the credit reporting agencies are doing enough to 
combat identity theft? 

A.I. I am gratified by the credit reporting agencies’ adoption of sev- 
eral new programs to assist victims of identity theft. The police 
report blocking initiative, the joint fraud alert, and their endorse- 
ment of our uniform identity theft affidavit all demonstrate a will- 
ingness on the part of the agencies to work with the Federal Trade 
Commission in finding ways to relieve the burden on victims of 
identity theft. As discussed in the Commission’s July 10, 2003 testi- 
mony, the Commission supports legislative codification of these 
practices. 

As further outlined in the Commission’s testimony, we believe 
that there are areas where the consumer reporting agencies can do 
more to help in the area of identity theft. Providing consumers 
with access to free credit reports may alert them to possible iden- 
tity theft. In addition, free reports will enable consumers to keep 
a closer watch on their credit history. 

RESPONSE TO WRITTEN QUESTION OF SENATOR MILLER 
FROM J. HOWARD BEALES, HI 

Q.l. What legislative remedies would you recommend that the Sen- 
ate Banking Committee include in a FCRA bill? 

A.l. The Commission’s July 10 testimony set forth specific legisla- 
tive recommendations to the Committee. 

RESPONSE TO WRITTEN QUESTION OF SENATOR MILLER 
FROM TIMOTHY CADDIGAN 

Q.l. In Mr. Harrison’s testimony he discusses the fact that Army 
officials at Ft. Bragg, North Carolina, issued his identity theft per- 
petrator an active duty military identity card in his name and So- 
cial Security number and that he has had trouble clearing up his 
identity issues. Is the Secret Service also working with the military 
to combat identity theft? If so, to what degree? 

A.l. The Secret Service works with many different State and local 
law enforcement agencies, as well as military law enforcement 
units, through our local field offices across the country. In cases in- 
volving military personnel as either victims or perpetrators, the 
individual military units (Army CID, Navy CIS, or Air Force OIG) 
and our local field offices collaborate on the investigation. 

On a national level, the new Identity Crime Video/CD-ROM the 
Secret Service has produced in partnership with the International 
Association of Chiefs of Police and others is being distributed to 
every local and State law enforcement agency in the country, in- 
cluding each military law enforcement office on every military base 
in the United States. In addition, the Secret Service provides re- 
sources on counterfeit checks, counterfeit documents, credit cards, 
and fictitious instruments to military investigators, all of which can 
be highly useful to an identity crime investigation. 
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RESPONSE TO WRITTEN QUESTIONS OF SENATOR DOLE 
FROM MICHAEL D. CUNNINGHAM 

Q.l. Mr. Cunningham, how does affiliate sharing assist in your 
business’ efforts to combat identity theft? 

A.l. From a fraud perspective, affiliate sharing allows us to pre- 
vent our customers from becoming identity theft victims through 
address verification and fraud files. For example, a mortgage can 
be used to verify the address on a credit card application. Imagine 
having a mortgage with a company that contacts you because they 
need to verify your address on a credit card application. Affiliate 
sharing also allows us to expedite processing and avoid the incon- 
venience customers may experience if we required them to submit 
documentation. Furthermore, if a customer becomes a victim of 
identity theft, through affiliate sharing we can prevent additional 
account compromises and facilitate a quicker recovery of funds and 
the victim’s identity. Affiliate sharing also provides us with en- 
hanced servicing opportunities by offering targeted products to our 
customers. 

Q.2. After our last hearing on the Fair Credit Reporting Act Au- 
thorization my friend. Senator Dodd, was good enough to send me 
a copy of a series of articles written by the HartfordCurrent re- 
cently which detailed some very distressing charges of errors the 
paper says have been built into the credit reporting system. One 
such charge was that credit reporting agencies have the incentive 
to put false information in a credit report because a potential cred- 
itor is more likely to buy a report with more information in it be- 
cause they assume that it must be more accurate. I find that hard 
to believe. Mr. Cunningham, since you represent a bank which pur- 
chases credit reports, would you comment on that charge? 

A.2. We value the data integrity, not the quantity of data, when 
contracting with the credit bureaus. 

RESPONSE TO WRITTEN QUESTION OF SENATOR MILLER 
FROM MICHAEL D. CUNNINGHAM 

Q.l. Do you think that the credit bureaus are doing enough to help 
victims of identity theft clear and correct their information? 

A.I. I believe the credit bureaus are focused on assisting victims 
in recovering their identity and preventing additional occurrences. 

Please feel free to contact me if I can be of any additional assist- 
ance to the Committee on this very important issue. 

RESPONSE TO WRITTEN QUESTION OF SENATOR DOLE 
FROM JOHN M. HARRISON 

Q.l. Mr. Harrison, your testimony was excellent and I believe it 
gave us a new appreciation for the ordeal victims of identity theft 
go through. I would like to clarify a few of your points for the 
record. In your written testimony you state, “My conclusion is, 
there is no system in place to assist an identity theft victim when 
banking accounts are opened in your name and Social Security 
number, but are completely removed and unrelated to your own 
banking accounts. This industry is well behind the progress that 
has been made in the credit industry.” You appear to be holding 
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up the credit bureaus, even though they admittedly have problems, 
as an example for banks. Is that accurate? 

A.l. Thank you for allowing me the opportunity to clarify part of 
my testimony for you. Your question is in regards to my comment 
about fraudulent banking accounts, the system surrounding those 
accounts and whether I am holding up the credit bureaus as an ex- 
ample for banks. 

In fact, it is not the credit bureaus I am holding up as an exam- 
ple, it is the system surrounding the credit industry as a whole 
that I am comparing to the banking industry’s system. In my own 
situation, I have dealt with both types of fraud and I am in a good 
position to make the comparison. The problems that do exist within 
the credit system are a result of the participants not meeting their 
responsibilities; not the system itself 

Creditors have a choice between three credit reporting agencies 
for account authorization and also to report both positive and nega- 
tive information on consumers. Even after my identity was stolen 
and the many fraudulent accounts were opened, it could have been 
a manageable situation for me had the repositories, creditors, and 
debt collectors simply followed the rules within the system. That 
happens less than most people would think and the consequences 
they face for repeatedly making the same mistakes are minimal. 
Still . . . within that system a victim can maintain their hope. The 
fraudulent information is contained within those three repositories. 
Through persistence, through repetitiveness, a victim can order the 
reports, dispute the fraudulent accounts and continue to do that 
until one day, the updated reports have no more erroneous infor- 
mation on them. 

It did not take me long to learn that this same process cannot 
be used when dealing with savings and checking accounts fraudu- 
lently opened in my name. That system, or lack thereof, is far more 
complex, less cooperative, and not consumer-friendly. Banking ac- 
counts and bad checks get reported in many more databases than 
credit accounts. The majority of companies that maintain these 
databases do not consider themselves reporting agencies and there- 
fore do not adhere to the FCRA. These companies feel no responsi- 
bility to assist victims or send them consumer reports. This creates 
a problem getting information and also makes it difficult for a vic- 
tim to verify the negative information has actually been removed 
from the database. 

An identity theft victim dealing with bank fraud must commu- 
nicate with banks, merchant’s that accept checks, the merchant’s 
check service company, and national databases to resolve their sit- 
uation. Literally, there are hundreds of companies storing informa- 
tion on consumers and all that information is shared between those 
companies. Additionally, not all the information that is stored in 
those databases is listed under the victim’s Social Security number. 
Companies that maintain databases of bad check writers store that 
information under driver’s license numbers and routing/account 
numbers for each check. The average consumer would not have an 
understanding of how information is stored in these databases or 
how they relate to one another. Without that understanding, a vic- 
tim of check fraud cannot get to the information contained in these 
databases to dispute it. 
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The second great difficulty that I discovered is when a fraudulent 
credit account is opened in your name and you are successful in 
resolving the account with the creditor and the credit bureau re- 
porting it, all transactions associated with that account are also re- 
solved. This is not the case with checking accounts. Even if you are 
successful in removing the fraudulent information from the report- 
ing agency, even if you successfully dispute the account directly 
with the bank that opened it; each check written on that account 
has already become its own individual debt. There is still a mer- 
chant, his/her debt collector, or the merchant’s check management 
company attempting to collect on the bad check. 

Still another difference between credit fraud and checking fraud: 
When a creditor suspects fraud and closes the account, the credit 
account is no longer useable by the imposter. When a bank closes 
an account for cause, the imposter can still continue using those 
checks for weeks or even months. 

My belief is the hundreds or even thousands of these check man- 
agement companies are credit reporting agencies. They maintain 
information files on consumers. That information is sold to their 
customers and used in the legitimate business transaction of 
whether a check is accepted or declined by the merchant. Further, 
they share consumer information with their affiliates and some of 
their websites indicate they also sell consumer information to third 
parties. A great deal of attention has been paid to the three major 
repositories and the credit industry themselves has at least ac- 
knowledge the problem of identity theft and are addressing it. The 
banking/checking industries are virtually silent on the issue of 
identity theft and have not even begun to put procedures in place 
to assist victims of identity theft. 

I hope this sufficiently clarifies my comment and again I appre- 
ciate this opportunity to further address the issue of banking/ 
checking fraud. Through default, I have a great deal of knowledge 
and experience with the systems victims encounter in attempting 
to restore their names and reputations. Please feel free to call upon 
me at any time to answer questions or inquiries about the reality 
of those systems. 

RESPONSE TO WRITTEN QUESTION OF SENATOR MILLER 
FROM JOHN M. HARRISON 

Q.l. Mr. Harrison, I am sorry to hear about your personal situation 
regarding your identity theft. It does sound like it has been a chal- 
lenge. Let me ask you, in your statement you say, “Equifax has 
failed to meet nearly all the provisions of the FCRA.” Could you 
tell me what you mean by that statement so I can understand your 
point of view better? 

A.l. Thank you for allowing me the opportunity to clarify part of 
my testimony for you. You have asked me to provide additional un- 
derstanding of the statement in my written testimony, “Equifax 
has failed to meet nearly all the provisions of the FCRA.” 

I can begin by giving you a snapshot of what appears on my re- 
pository reports 21 months after learning I was an identity theft 
victim. There are no fraudulent accounts appearing on either my 
TransUnion or Experian reports presently. At times, new debts re- 
lated to my identity theft appear on my Experian report, but the 
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situation is manageable and I can generally have those accounts 
removed with an online dispute to Experian. TransUnion allowed 
me to take advantage of a new California law to freeze my credit 
report. They offered this to me free of charge and since my report 
was frozen, I have had no accounts related to my identity theft ap- 
pear on my TransUnion report. 

In contrast, there are still 30 fraudulent accounts being reported 
by Equifax presently. Those 30 accounts are being reported on 2 
separate reports that Equifax has in their system in my name and 
Social Security number. Equifax consistently sends one of those re- 
ports to my creditors and it contains 18 fraudulent accounts. Many 
of those accounts were disputed and thought resolved in November 
and December 2001. There are also 110 inquiries on that report 
from companies that requested my file. The second report, which 
Equifax sends to me when I request my consumer file, only con- 
tains 12 fraudulent accounts. There are 26 inquiries from compa- 
nies on this file. 

While both TransUnion and Experian responded to each of my 
dispute letters, it took 11 months and three dispute letters to get 
my report from Equifax. When I finally received that report and 
the results of my reinvestigation, Equifax had failed to delete the 
accounts which they said would be deleted as a result of that inves- 
tigation and those accounts still remain on my report. Equifax still 
has my current address, current employer, and phone number 
wrong in their system despite my efforts to correct them. They also 
refused to investigate any of the inquiries they were generated as 
a result of fraudulent accounts claiming they are a factual repre- 
sentation of my consumer file. 

For certain I have had some difficulties with the other two re- 
positories and they have made mistakes that are clear violations of 
the FCRA. However, I have always felt they were at least making 
an effort to comply with FCRA and those mistakes were easy for 
me to overlook. Equifax in my opinion has made no effort on my 
behalf. I do not believe they have taken the time to read any of my 
dispute letters or review the 18 pages of supporting documentation 
I included with those letters. If someone at Equifax had set out to 
deliberately make a mess of my credit file; I do not believe they 
could have done a better job of it than exists right now. 

I hope this sufficiently clarifies my statement about Equifax and 
again I appreciate this opportunity to be a part of the process. 
Through default, I have a great deal of knowledge and experience 
with the systems victims encounter in attempting to restore their 
names and reputations. Please feel free to call upon me at any time 
to answer questions or inquiries about the reality of those systems. 

RESPONSE TO WRITTEN QUESTION OF SENATOR MILLER 
FROM LINDA FOLEY 

Q.l. Do you think the credit bureaus are doing enough to help vic- 
tims of identity fraud clear and correct their information? If not, 
what should they do? 

A.l. ITRC does not think that the CRA’s are doing enough. While 
we recognize that the CRA’s are just data collectors, they have also 
accepted the role of helping in dispute and information manage- 
ment and that is where they tend to fall down. 
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1. Failure to follow established dispute process — ITRC has heard 
from victims that use the designated CRA dispute process (fill out 
the dispute form, attach police report and evidence). Only it ap- 
pears that the evidence or items submitted with the dispute form 
is not forwarded to the credit issuer or collection agency. This re- 
sults in the dispute being denied and forcing the victim to try to 
contact the issuer directly, creating more delays and time con- 
sumed by the victim in resolving issues. Due to this problem, ITRC 
is now advising victims to deal directly with the issuers rather 
than the CRA’s to avoid these delays. The only exception is in Cali- 
fornia where the CRA is required to block the item. In this State, 
the ITRC recommends that the consumer contact both the CRA’s 
and the issuers which results in additional costs and time for the 
consumer. 

2. Blocked line items — ^When the CRA blocks a line item, it needs 
to be blocked from everyone. ITRC has heard from too many con- 
sumers that an entity requesting a report sees items that were 
blocked or suppressed. In other words, the report the consumer re- 
ceives shows that the item has been removed/blocked but the item 
is still shown on the report sent to the commercial requester. 

3. Misinformation and half matches — The CRA’s appear to in- 
clude information either in a report or on a “suppressed” file that 
was from an application that partially matches the consumer. For 
example, the name is the same but spelled differently (Swanson v. 
Swansson) and the Social Security number matches 7 of the 9 
numbers. That application is included in the consumer’s file even 
though it is only a partial match. This results in misinformation 
affecting credit decisions. This misinformation may be the result of 
an identity theft attempt — shoulder surfers or dumpster divers who 
did not quite remember or see the full information. 

4. Non-English speakers — The CRA’s require all consumers to use 
automated phone systems or the mail to request a credit report. 
The automated systems are in English only. We need to allow all 
consumers access to this vital information. The automated systems 
must have a Spanish language option and perhaps the ability to ac- 
cess an AT&T language translator for help in ordering his/her cred- 
it report. In addition, the CRA’s must send instructions on how to 
read a report in the requesting languages or at least in maybe 5 
of the languages that the national census shows are the largest 
population groups. 

5. Access to fraud specialists — Due to the automated systems, 
consumers can only speak with a CRA consumer rep when they 
have a report and then only for about 3 months after receiving the 
report. They call a special number, type in the report number and 
are connected. If that 90-day window has ended, they cannot access 
a person to ask questions. Due to the complexity of this crime, vic- 
tims need longer access to CRA personnel. ITRC would recommend 
that period of time be extended to 180 days, minimum. 

6. Access to fraud specialists — It has also been reported by some 
of the victims that once they get their reports, they are only al- 
lowed one phone call to a fraud investigator at a bureau and then 
that report number no longer allows them access to the bureau’s 
fraud division. 
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7. Two files-one Social Security number — Recently a victim called 
ITRC with the following complaint. It is one that we have heard 
numerous times before. The car dealer asked for a credit check 
using the man’s Social Security number only. A report came in 
with his Social Security number but with another person’s name 
and information. When the dealer asked for a report with the vic- 
tim’s name and Social Security number a totally different report 
came back. In other words, there are two reports with the same So- 
cial Security number. The second report with the different name is 
an imposter (in this case a family member) who stole the victim’s 
identity when he was a child. In fact, it even says on the report 
that credit was established prior to the age of 18 and includes a 
bankruptcy. This man is in the military and this problem may af- 
fect his entire career. 

8. Time issues — In some cases of identity theft, clearing up the 
problem is time sensitive. A park ranger called today. She was just 
told that a financial check showed a collection notice from First 
Premier Bank. She now must wait about 2 weeks for her credit re- 
ports and is unable to get beyond a customer rep at the bank to 
find out about this credit card she never opened. What she does 
know is that it is in her name and Social Security number but with 
an address she never lived at. She cannot wait several weeks to 
clear up this problem. The job will be gone tomorrow unless she 
can deal with this today. With the automated systems, there is no 
one to talk with for a line-block during investigation at the bureaus 
until she gets her report — which will be too late to help her. This 
is a common problem for those dealing with job background checks, 
loans for purchasing homes/car, or checks done for tenancy. 

9. CRA cross-linking files — Some victims of extreme identity theft 
situations change their Social Security number. It is a last ditch 
effort to disassociate from a thief that is unstoppable. It brings se- 
vere consequences since so much of our personal history is linked 
to that number. You lose your college records, credit history, and 
more. It is as if you were born yesterday. People question you — are 
you a thief who has just made up the information, an illegal immi- 
grant, etc.? ITRC only recommends this step in the worst of cases. 

It has been brought to ITRC’s attention that in some cases the 
CRA is cross-linking the old and new Social Security number — an 
action that negates the changing of the Social Security number. 
Old and new numbers must remain separate (except with SSA and 
IRS per policy) or this extreme measure is ineffective. The purpose 
of changing one’s Social Security number is to stop the thief from 
using your information. If the CRA cross-links the numbers, the 
thief’s actions appear on the new Social Security number and cred- 
it report. This means the victim is once again compromised. The 
CRA report is also a source of information for bail bondsmen and 
law enforcement. Unfortunately, many of these severe cases had 
thieves who broke the law while using the victim’s Social Security 
number. This cross-linking may also result in the arrest of an inno- 
cent person. 

We would also like to address a couple other topics that were 
brought up by other panel members: 

1. Mandatory Fraud Alert Observation: This has been a topic 
that is a sore spot for many victims and consumers. Far too many 
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victims have placed alerts on their credit reports only to have com- 
panies ignore them. The bottom line is this: Why does a company 
have the right to ignore my warnings or requests, placed for their 
benefit to protect both the company and the consumer from fraud? 

2. In the current version of the House Bill H.R. 2622, there is a 
mandatory observation section. There are two problems with this 
bill. First, it includes only those who already are victims. Con- 
sumers who wish to place a “security alert” as a proactive measure 
are unable to do so. It is vital that we act proactively and not just 
help in remediation. Second, the bill allows retailers to decide 
either to honor the “alert me notice in the following manner” which 
was placed by the consumer or to decide an alternate method. The 
problem with this is that info usually used is from the credit re- 
port. Once an imposter has become active in your life your credit 
report no longer represents your true information and only the 
thief would be able to answer any questions based on the report. 

Thank you for the opportunity to work with your Committee. 

RESPONSE TO WRITTEN QUESTION OF SENATOR MILLER 
FROM WILLIAM HOUGH 

Q.l. Do you think the credit bureaus are doing enough to help the 
victims of identity fraud clear and correct their information? If not, 
what should they do? 

A.l. The current system of reporting identity theft problems to the 
credit bureau could be improved by providing one toll-free 800 
number that would allow the consumer to notify all bureaus of 
their situation. Thus, through centralized notification, all bureaus 
would place an identity theft alert on the consumer’s files with one 
call. This 1-800 process, I believe, is currently being developed and 
would be a significant benefit. 

On the subject of clearing and correcting consumer information, 
over the past few years the credit bureaus and the industry have 
developed several tools to handle the information correction process 
more efficiently. For example, the E-OSCAR system (Online Solu- 
tion for Complete Accurate Reporting) allows both merchants and 
credit bureaus to respond quickly (via Internet access) to these con- 
sumer inquiries and get them resolved faster. 

While any process can always be enhanced, the credit bureaus 
have and continue to make significant progress to aid identity theft 
victims. 

RESPONSE TO WRITTEN QUESTION OF SENATOR MILLER 
FROM MICHAEL W. NAYLOR 

Q.l. Do you think the credit bureaus are doing enough to help the 
victims of identity fraud clear and correct their information? If not, 
what should they do? 

A.l. We believe credit bureaus can do more, and act more effi- 
ciently and effectively, to prevent identity theft from occurring, and 
to help victims recover their good credit and name after the fact. 

The AARP’s recommendations for increasing the involvement of 
consumer credit reporting agencies (CRA’s) to help solve this prob- 
lem, include: 



215 


• Requiring CRA’s to provide consumers with at least one annual 
free credit report a year to make it easier and less expensive for 
consumers to monitor their credit reports. 

• Requiring subscribers who purchase credit reports from CRA’s to 
provide the same standard of identification to retrieve a con- 
sumer’s credit report as is required of consumers seeking their 
own credit report. Because the CRA’s have procedures in place 
for consumer access, these same procedures can be applied to 
subscribers requesting credit reports. 

• Allowing consumers to place a security freeze on their credit re- 
port, and issue to consumers a password to prevent their credit 
report from being accessed without their express authorization. 

• Requiring CRA’s to permanently block fraudulent accounts on 
the credit reports of identity theft victims. 




AFFILIATE SHARING PRACTICES 
AND THEIR RELATIONSHIP WITH 
THE FAIR CREDIT REPORTING ACT 


THURSDAY, JUNE 26, 2003 

U.S. Senate, 

Committee on Banking, Housing, and Urban Affairs, 

Washington, DC. 

The Committee met at 10:07 a.m. in room SD-538, Dirksen Sen- 
ate Office Building, Senator Richard C. Shelby (Chairman of the 
Committee) presiding. 

OPENING STATEMENT OF CHAIRMAN RICHARD C. SHELBY 

Chairman Shelby. The hearing will come to order. 

First of all, I want to thank the witnesses for being here today. 
This morning, we are examining the provisions of the Fair Credit 
Reporting Act which established the rules for information sharing 
among affiliated entities. 

I believe that this is an area which deserves particularly close 
scrutiny in the reauthorization process because of the considerable 
changes that have occurred in the financial service sector since the 
passage of the 1996 Fair Credit Reporting Act amendments. 

Frankly, activities which were once strictly prohibited now com- 
monly occur within the industry. The changes made to the financial 
services laws permit financial services firms to engage in new lines 
of business and to operate using larger and much more complex 
corporate structures. 

The purpose of this hearing is to consider this contemporary 
landscape and assess how well the Fair Credit Reporting Act oper- 
ates in the context of current practices. To do this, I believe we 
must consider the types of affiliate structures firms use and look 
at the kinds of information they share and ascertain the purposes 
for which they share it. 

We must also examine the level of consumer understanding of 
information-sharing practices — are the consumers aware that their 
financial information is shared, do they recognize the range of enti- 
ties it is shared with, does such sharing pose any threats to them, 
do they have concerns about such sharing, do they have choices re- 
garding controlling the sharing? 

Hopefully, through the course of today’s hearing, we can address 
these issues. As we go forward, we will have to closely measure 
these issues in order to be able to develop a product that achieves 
the most effective, efficient, balanced, and fair system possible. 

Senator Johnson. 
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STATEMENT OF SENATOR TIM JOHNSON 

Senator Johnson. Well, thank you, Chairman Shelby, for holding 
today’s hearing on affiliate sharing and the Fair Credit Reporting 
Act. I would like to welcome today’s witnesses whose thoughtful 
written testimony has been helpful in laying out both the benefits 
of information sharing and some concerns that we should keep in 
mind as this debate goes forward. 

I would also like to extend a special welcome to Terry Baloun, 
who is a Regional President and Group Head of Wells Fargo Bank 
in South Dakota, North Dakota, Montana, and Western Minnesota. 
Terry has spent a good deal of time in communities throughout our 
State, and he knows firsthand the challenges of bringing meaning- 
ful credit opportunities to rural America. We face particular chal- 
lenges, from low population density to specialized issues related to 
agricultural lending, and Wells Fargo plays an important role in 
the financial services sector in the Upper Midwest. 

In fact, national firms like Wells Fargo and Citigroup, which is 
also represented here today, are critical to the economic vitality of 
rural States like South Dakota. While smaller local banks and 
credit unions are the lifeblood of our communities, and provide crit- 
ical lending services to people throughout rural States, their serv- 
ices are complemented by larger financial conglomerates like Wells 
and Citi. Some people prefer to patronize small banks, some prefer 
credit unions, and some prefer the one-stop shopping they find at 
larger financial services firms. 

The point is that people have choice. And in rural America, we 
do not take that for granted. For example, in the area of health in- 
surance, by August, we will have only two insurance companies left 
in my State offering individual policies, and the lack of competition 
has had devastating results on farmers, ranchers and other self- 
employed workers. But the nationwide system of credit that now 
permits companies to operate around the country with one set of 
rules overcomes the negative economics of a small population living 
across a large State. 

The expanded choice in the financial services marketplace ex- 
tends beyond simply the type of financial institution to an explod- 
ing array of financial products now available to retail customers, 
ranging from complex to the simple. For example, Citigroup allows 
mortgage customers to pledge from a Smith Barney brokerage ac- 
count to collateralize the loan rather than liquidate the portfolio to 
come up with a downpayment. By the same token. Wells Fargo cus- 
tomers can pay their mortgage at any local branch or ATM, even 
though the mortgage company and the bank are separate entities 
within the same corporate family. Neither of these services would 
be possible without information sharing among affiliates. 

On the retail side, affiliate sharing has benefits as well as Mr. 
Prill notes in great detail in his written testimony. These range 
from making computerized returns without a receipt, to storage 
and retrieval of warranty information, to returns of Internet pur- 
chases to a brick-and-mortar storefront, to screening for bad checks 
through an instant authorization system. And of great relevance to 
our discussion last week, customer information is critical in pre- 
venting identity theft in both the retail and the banking sectors. In 
fact. Special Agent Caddigan of the Secret Service and Mr. Beales 
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of the Federal Trade Commission stated unequivocally that infor- 
mation sharing, and in particular information sharing among affili- 
ates, can play a critical role in our enforcement efforts against 
identity theft. 

Are these financial services absolutely necessary? Well, probably 
not. The world does not come to an end in a cash economy. And 
I want to make clear that I take seriously the concerns some of to- 
day’s witnesses raise about affiliate sharing. But the impact of 
product innovation on economic growth, consumer choice, and the 
democratization of credit have been undeniable. 

It is this very balance between growth and innovation on the one 
side, and individual privacy rights on the other, that drove Con- 
gress’ decision in 1996 to preempt seven critical provisions of the 
FCRA from State action. We wanted to encourage a national mar- 
ketplace for credit that maximizes appropriate consumer access to 
affordable credit and, to a remarkable degree, we have succeeded. 

Again, I believe this issue fundamentally is about consumer 
choice. And that includes a consumer’s right to choose not to be 
part of an affiliate-sharing arrangement. The first opportunity to 
choose comes when a consumer decides to establish a relationship 
with a company: in some sense, the decision to do business with 
a larger or smaller institution is the ultimate opt in. The second 
opportunity to choose comes when the consumer is presented with 
an opportunity to opt out of affiliate sharing. To be effective, this 
option must be clear and meaningful. I am interested in hearing 
from the witnesses what steps, if any, they would suggest beyond 
the mandatory privacy notices to give customers a meaningful opt 
out opportunity. 

So thank you. Chairman Shelby. I thank you. Senator Sarbanes, 
for your leadership on this issue, and I look forward to the oppor- 
tunity to hear more from this panel. I have several other conflicting 
obligations, and I will likely have to excuse myself prior to entire 
panel being concluded. 

Thank you, Mr. Chairman. 

Chairman Shelby. Senator Bennett. 

STATEMENT OF SENATOR ROBERT F. BENNETT 

Senator Bennett. Thank you, Mr. Chairman. 

I remember from my own business experience that one does not 
seek a bank, one seeks a banker. One seeks a relationship where 
you are known, your background is known, and therefore you can 
deal with a sense of confidence, and the banker can deal with a 
sense of confidence about your background. 

If we put up artificial barriers within financial institutions to the 
sharing of information, we create a situation where one cannot be 
known. As Senator Johnson has said, the first opt in is the choice 
you make as to the organization with whom you deal, and once you 
have made that choice, it seems to me, as a consumer, you want 
everyone in that organization to know all about you so that the 
good reasons they have to give you credit or offer you products in 
one part of the organization will go with you to the other part of 
the organization, and you will not have to reintroduce yourself 
again and again to try to get those services. 
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If you find, as some witnesses have suggested in previous hear- 
ings, that you are being badly dealt with as a result of the way 
that information is shared, this is America, and you can walk out 
the door and take your business someplace else. I am always inter- 
ested that many of the people who get upset about activities that 
businesses engage in assume that the business exists to fleece you. 
I can assure you that business exists to get a consumer to come 
back. 

Business exists to try to have as much repeat business from reli- 
able consumers as it possibly can. I am using the wrong pronouns 
here. Business people, there is no such thing as a business, busi- 
ness people want to have as many repeat customers as they pos- 
sibly can. They want to build brand loyalty and customer loyalty, 
and as I have heard some horror stories that said a bank did this 
or bankers did this or that with my information, the immediate re- 
action I had was why would any customer ever deal with that 
banker again if, in fact, that was done? The ultimate opt out is the 
one to which Senator Johnson has referred, that you take your 
business, and you go someplace else. 

So intelligent businessmen and women will do everything they 
can to use the information within affiliates in a way that will ben- 
efit the consumer so that the consumer will want to come back, will 
want to stay with that institution and all of its affiliates, and that 
is the way successful businesses are built, and that is the way con- 
sumers want it, and that is one of the magic aspects of American 
commerce. 

We have more flexibility, consumers have more choices, they 
have more opportunities to expand their purchasing options in 
America than anyplace else, and I think the sharing of information 
intelligently and for the purpose of trying to build repeat business 
is one of the reasons that American consumers are so well-served. 

So, I will look forward to the testimony from the witnesses, and 
hope that the prejudices and preconceptions that I have just out- 
lined will either be confirmed or corrected, depending on the infor- 
mation the witnesses have to share with us today. 

Thank you, Mr. Chairman. 

Chairman Shelby. Senator Sarbanes. 

STATEMENT OF SENATOR PAUL S. SARBANES 

Senator Sarbanes. Mr. Chairman, thank you very much. I com- 
mend you for holding what I regard to be quite an important hear- 
ing on affiliate sharing practices and regulation. 

I think it is fair to say an affiliate used to be one of a small 
group of companies performing a similar business. Today, an affil- 
iate could be one of hundreds or more companies, many of which 
engage in different businesses, and the question, of course, is in the 
minds of many consumers, that broad scope of affiliates are often 
thought of as third parties. So there has been a quantum expan- 
sion, I think, in the concept of affiliates, and we need to bear that 
in mind. 

Of course, we are looking now at the problem of whether to ex- 
tend the Federal preemption of State law which governs affiliate 
sharing and, if so, under what conditions, and that poses important 
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questions about the right of consumers, in terms of what can be 
done with their confidential financial information. 

The information under current law which can be disclosed is 
really quite far-reaching: savings and checking account balances, 
certificate of deposit maturity dates and balances, checks individ- 
uals write, checks deposited in a customer’s account, stock and mu- 
tual fund purchases and sales, life insurance payouts and so forth. 

So that the universe of confidential and sensitive financial infor- 
mation that is being shared or sold has not only increased dramati- 
cally over the past several years, but I am not sure consumers are 
fully abreast of how widespread it is. 

This is underscored, of course, because every survey shows con- 
siderable sensitivity on the part of people with respect to the pri- 
vacy of their financial information. In California, where privacy has 
become a major issue, statewide polls show from 75, 85, 90 percent 
say consumers should provide their permission for the use of the 
financial information. There have been efforts at legislation. In 
California, I understand that this issue may go to initiative. So it 
may be put to the electorate in a very different form than the abil- 
ity to work at it, as one can do, in a legislative context. 

Hopefully, this hearing will help to develop what specific con- 
sumer data financial institutions circulate to affiliated businesses, 
for what purposes the affiliates use such data, the awareness of 
consumers as to which businesses are receiving their information. 
These are all important questions, and obviously the sensitivity 
across the country, I think, to the question of the privacy of finan- 
cial information is growing and growing. And I think we have to 
figure out some way to address it. I hope we will hear, in that re- 
gard, from the panel, including the representatives of the financial 
institutions, which after all have a major interest in this question 
as well, but I do not think the issue in the country has reached 
anything approaching equilibrium, where people are satisfied with 
a situation. Therefore, until that occurs, there are going to be con- 
tinuing calls for action of one sort or another, whether it be regu- 
latory, legislative, or even, as California is considering, actually ini- 
tiated right from the electorate to try to deal with this issue. 

Thank you, Mr. Chairman. 

Chairman Shelby. Senator Allard. 

STATEMENT OF SENATOR WAYNE ALLARD 

Senator Allard. Thank you, Mr. Chairman. I will be brief I just 
want to thank you right at the start for holding this hearing. I 
want to thank the witnesses for agreeing to be on the panel. You 
being a part of this discussion is really important. It is not always 
easy to get away from your jobs and businesses to be here, but I 
look forward to hearing your comments. 

Information sharing is a vital part of the U.S. financial and busi- 
ness systems and it has contributed to the vibrancy of the U.S. 
economy. While it is necessary to protect a consumer’s personal in- 
formation, certain sharing of information is necessary for U.S. fi- 
nancial and business systems to function and operate smoothly. 

Affiliate sharing allows the operation of our national credit re- 
porting system by enabling lenders to perform effective credit un- 
derwriting and credit monitoring. This ability is important for the 
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industry to reduce their overall risk of loss. At the same time, cus- 
tomers deserve protection of certain information. I look forward to 
today’s discussion of affiliate sharing and how this Committee can 
facilitate striking the appropriate balance between consumer pro- 
tection and business needs. 

Again, I would like to thank the witnesses for agreeing to testify 
and thank you, Mr. Chairman. 

Chairman Shelby. Senator Carper. 

COMMENTS OF SENATOR THOMAS R. CARPER 

Senator Carper. Thanks, Mr. Chairman. 

To all of our witnesses, welcome. I am pleased I get to spend at 
least a little bit of time with you. We have got a whole bunch of 
things going on this morning. I will be in and out of the hearing. 

One of the things I would hope that will come out here for us, 
as we try to move forward on the question of FCRA and the pre- 
emption provisions, a focus on how are consumers better served by 
the sharing of information across the company and through affili- 
ates, and how are consumers better off because of that. 

Also, I would add that, we have a good mix of witnesses here, 
people with a lot of different perspectives, and I think very helpful 
perspectives. And for me, for a hearing like this to be really suc- 
cessful, I walk away from the hearing finding common ground and 
listening to thoughts of each of our witnesses, from their own per- 
spectives, the world in which you live, to try to weave it together 
into some kind of a consensus, and I would ask that you keep that 
in mind, and to the extent I get to ask a question, I am going to 
be asking you where you see the common ground emerging on this 
issue among this disparate panel. 

Thank you very much. 

Chairman Shelby. Thank you. I want to welcome our distin- 
guished panel of witnesses. 

Oh, Senator Dole. We cannot forget her. 

STATEMENT OF SENATOR ELIZABETH DOLE 

Senator Dole. Thank you, Mr. Chairman. I know I am way down 
here on the end. 

Chairman Shelby. I had your name here. Sorry. 

You have been waiting patiently. 

Senator Dole. Thank you. 

In the past two hearings on the issues pertaining to the reau- 
thorization of the Fair Credit Reporting Act, I have discussed the 
importance of affiliate sharing with some of our witnesses. In each 
instance, the witness agreed that affiliate sharing is vitally impor- 
tant. Today, we have the opportunity to more fully explore the nu- 
merous advantages that affiliate sharing provides to consumers, fi- 
nancial institutions, and public policy objectives. We all benefit now 
that judgments based on race and gender have been taken out of 
the equation of credit worthiness, and one can now walk into a 
store and obtain a line of credit in minutes. Consumers clearly ben- 
efit when they are able to call a single person, as has been men- 
tioned several times this morning in their bank, and that customer 
service agent is able to access each of their different accounts at 
once. We all know the frustration of being transferred from person- 
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to-person when we are attempting to get our questions answered 
at a bank. With affiliate sharing, increasingly more institutions are 
able to develop systems to minimize the need to transfer customers 
from department-to-department. 

In addition, affiliate sharing allows financial institutions to real- 
ize greater efficiencies by permitting them to consolidate customer 
service and administrative functions for their affiliate businesses. 
A loss of all or part of the affiliate-sharing preemption would result 
in an increase of time and money wasted by consumers across the 
country, not to mention the increased frustration caused by being 
passed from person-to-person at their bank. Let me be clear: Pri- 
vacy of personal information is very important, and I will work to 
implement reasonable protections. However, we must strive for a 
balance and should not sacrifice the efficiency of our credit system 
in the name of privacy. In many ways, I believe our responsibility 
is like that of doctors in the Hippocratic Oath: “First, do no harm.” 

Just as importantly, affiliate sharing assists financial institu- 
tions in antiterrorism efforts and in detecting and preventing 
money laundering. A customer service agent who can review all of 
a customer’s accounts is more likely to spot potential problems or 
concerns. The value of this added benefit is extremely important, 
especially when we rely so heavily on the vigilance of our financial 
institutions and their cooperation with law enforcement officials. 

It is my hope that today’s hearing will give us an opportunity to 
further explore these issues with our witnesses and that it will lead 
us all to greater appreciation of the advantages that consumers, in- 
dustry, and the Government receive from the practice. Finally, I 
want to thank our distinguished panel of witnesses for taking the 
time to join us here today, and I look forward to working with my 
colleagues as we move closer to reauthorizing the important pre- 
emptions contained in the Fair Credit Reporting Act. 

Thank you, Mr. Chairman. 

Chairman Shelby. Thank you. Senator Dole. 

Now, I want to welcome, again, our distinguished panel. 

First, Professor Joel Reidenberg, Professor of Law at Fordham 
University; Ronald Prill, Former President, Target Financial Serv- 
ices; Terry Baloun, Regional President and Group Head, Wells 
Fargo Bank; Julie Brill, Assistant Attorney General of Vermont; 
Martin Wong, General Counsel, Global Consumer Group, 
Citigroup, Inc.; Edmund Mierzwinski, Consumer Program Director, 
U.S. Public Interest Research Group; and Angela Maynard, Chief 
Privacy Executive and Counsel, KeyCorp. 

We will start with you. Professor. 

All of your written statements will be made part of the record, 
in their entirety, and if you would briefly sum up your top points. 

STATEMENT OF JOEL R. REIDENBERG 
PROFESSOR OF LAW, FORDHAM UNIVERSITY SCHOOL OF LAW 

Mr. Reidenberg. Thank you, Mr. Chairman, Ranking Member 
Sarbanes, and distinguished Members of the Committee. 

I commend you for convening the hearing today on this impor- 
tant issue and for the leadership you have shown in this area. I 
also thank you for the honor and privilege to appear before you. 
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I am Professor of Law at Fordham University School of Law, 
where I teach courses in information privacy law. I have written 
extensively on the regulation of fair information practices in the 
private sector and have written specifically on Fair Credit Report- 
ing Act issues. I have also advised Federal and State Government 
agencies on some FCRA litigation matters. 

I am appearing today as an academic expert on privacy law, and 
I am not representing any organization or institution. I am glad 
that you will be able to include the submitted statement for the 
record. I should also mention that my prepared statement draws, 
in part, on testimony I gave last month to the House Subcommittee 
on Financial Institutions. 

What I would like to do this morning is highlight three points 
in the testimony and then make several recommendations. The 
first point is a context-setting point, specifically that strong privacy 
protections are absolutely essential for the credit reporting system 
in the United States. As I will discuss in a few moments, I think 
the affiliate sharing provisions and practices undercut this basic 
principle for privacy law. 

When Congress enacted the FCRA in 1970, Congress acted in re- 
sponse to significant abuses in the credit reporting industry. The 
documented abuses included the release of credit information to 
noncredit granters, the dissemination of inaccurate credit informa- 
tion, the inability of consumers to gain access to their credit reports 
and the difficulty in making corrections. 

Scandals and distrust were harming the marketplace then. I 
think the affiliate sharing provisions will send us back to that era. 

The FCRA was a novel statute at the time of enactment because 
it established the basic principle that information collected for one 
purpose would be used for statutorily defined permissible purposes. 
Any other use needed consent. It included other important fairness 
criteria — like rights of access, and an ability to dispute inaccurate 
information and have it corrected. The FCRA included important 
safeguards for American citizens related to law enforcement such 
as due process requirements for access to credit report information. 
Overall, it provided a bedrock set of standards for fair information 
practices. 

I think it is also important to recognize that the FCRA never cre- 
ated an overall uniform national standard, as we have heard nu- 
merous times in the various hearings during the past month. In 
fact, at the original enactment. Congress and this Committee, in 
particular, endorsed the position of State officials when they testi- 
fied that we needed essentially a Federal floor to be supplemented 
by future State legislation. 

In the 1996 Amendments, the temporary and partial preemption 
clauses grandfathered three States. As a result, we have had dif- 
ferences from the start and even after 1996. The State differences 
have not impeded credit reporting or financial decisionmaking. In- 
deed, if we look at some of the statistics from the grandfathered 
States in 1996, we find that the lowest bankruptcy rates in the 
country are coming out of those three States and mortgage loan in- 
terest rates tend to be lower there than in other States. So we have 
not seen any problems arising from the fact that there are different 
standards. 
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Weakening of the privacy protections, on the other hand, is a 
major problem. Surveys show that 95 percent of Americans object 
to the secondary use of their personal information, and that is ex- 
actly what affiliate sharing is allowing to happen today. 

My second point is that there are some unintended consequences 
of the affiliate-sharing loophole that enable the complete cir- 
cumvention of all of the other protections in the Fair Credit Report- 
ing Act. 

Congress, in allowing affiliate sharing, exempted affiliate sharing 
from the definition of a consumer report. By exempting it in that 
fashion, key protections of the statute then are lost for information 
shared among affiliates although there is a notice requirement and 
a one-time opportunity to opt out. Large groups of affiliated finan- 
cial and nonfinancial organizations can easily engage in the same 
behavior that Americans found troubling and that caused the en- 
actment of the Fair Credit Reporting Act in the first place. 

To illustrate, let us take a look at some of the specific affiliate 
sharing provisions. 

The blanket exemption given for experience and transaction data 
opens a Pandora’s box. An organization can disseminate experience 
and transaction data, such as credit card performance information, 
insurance status, brokerage account activity among related compa- 
nies without the protections of the FCRA applying such as accuracy 
or correction. If data is shared with affiliates, once the affiliates ob- 
tain the information and start using it and resharing it with other 
affiliates down a chain of companies, accuracy will disappear and 
the protections do not apply. 

It is very hard to tell right now the significance of this exemp- 
tion. Because of the size of organizations, the scope is very poorly 
understood. I think it is very important that we learn about the 
specific data transfers that take place and the specific purposes for 
which they are being used. Consumers do not have access to this 
information. Consumers cannot simply walk out of the bank and 
start up a relationship with another bank in the hopes that their 
privacy is preserved because they cannot find out. 

More sweepingly, the affiliate-sharing provisions allow the com- 
plete circumvention of basic clauses. Communication to persons re- 
lated by common ownership are exempted from the definition. So 
we see some examples. It means storage limitations, the types of 
uses, all of those protections disappear. 

The industry has already testified at hearings that they are 
using this exemption in ways that subvert the original protections 
of the Act. TransUnion testified that they promote affiliate sharing 
to make underwriting decisions. Citibank testified earlier this 
month that it shares information among affiliates, including credit 
application, credit bureau data, information on transactions with 
customers. MBNA indicated it shares credit eligibility information, 
including credit reports among affiliates. 

Once their affiliates have the data — data that has been exempted 
from the definition of consumer reports — the other protections then 
do not apply to those affiliates. The potential circumventions are 
particularly disturbing when we consider the affiliations of some of 
the large groups. TransUnion, for instance, belongs to the Marmon 
Group. Marmon has a large series of businesses, including a 
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syringe needle business, and a residential water treatment plant. 
TransUnion provides a notice of affiliate sharing and an opt out. 
They can transfer credit reports wholesale to those companies. 

Experian is in the same situation. Experian is owned by a Brit- 
ish company, Great Universal Stores. Great Universal Stores also 
owns Metromail and Burberry’s. If Experian were to provide notice 
of affiliate sharing and an opt out, Experian could transfer the en- 
tire credit reporting database to Metromail, which is a direct mar- 
keting company. Well, as it turns out, Experian does just that. If 
you order a credit report from Experian online or if you subscribe 
to Experian’s service that provides the credit watch function, 
Experian gives a notice, and an opt out of affiliate sharing. I do not 
think there is any way a consumer would recognize that Metromail 
is now entitled to receive their credit report, could do anything 
with that credit report and none of the protections of the statute 
would apply. 

Affiliate sharing also allows the Government to engage in sur- 
veillance outside the due process protections of the FCRA. Equifax, 
for example, operates through a number of changing groups. It is 
a little hard to figure out exactly how their corporate structure is 
defined from reading their annual reports, but their apparent 
group of affiliates includes one that provides information services 
to the Government. Equifax’s Online Privacy Policy and Fair Infor- 
mation Principles statement informs consumers who request copies 
of their credit reports that they may disclose the information to af- 
filiates. 

Well, what that suggests is that Equifax would have an ability 
to transfer the credit report database to an affiliate that provides 
information services to the Government. Once the affiliate receives 
it, the permissible purposes and the due process restrictions would 
not apply. 

Now, in each of these examples, I do not have any specific infor- 
mation to suggest that these companies are, in fact, exploiting this 
loophole because, again, it is not possible for a consumer to learn 
that information. 

What you find, though, is these practices are clearly authorized 
by the statute, and the companies disclose that they intend to do 
these sorts of activities. We simply do not have the specific details 
of what they are doing. 

The last point that I would like to raise is that the affiliate shar- 
ing provisions raise very significant security risks and threats to 
the soundness of the credit reporting system. The problem is really 
the leakage of credit information to affiliates for secondary pur- 
poses; in other words, information being shared for purposes that 
were not the original permissible purposes. I believe such sharing 
enhances identity theft risks. 

This Committee heard last week from U.S. Secret Service Agent 
Timothy Caddigan that insider jobs are a significant source of iden- 
tity theft risk. To the extent that wide-ranging affiliate sharing 
starts moving this sensitive personal information across companies, 
down the chain from one to another, affiliate sharing magnifies the 
number of insiders who have access to personal data, without re- 
strictions on how it is used, and without the obligations that the 
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banking law imposes on banks, for instance, to maintain informa- 
tion security. Those protections are lost. 

Fraud detection, which we have heard about, certainly appears 
as an authorized purpose under the Fair Credit Reporting Act, a 
“legitimate business need.” It does not seem that the affiliate shar- 
ing exception is necessary for that purpose. 

I think, also, that affiliate sharing introduces a homeland secu- 
rity risk. The global reach of American companies and their affili- 
ates means that sensitive data can be transferred to affiliates in 
countries that are presently on State Department watch lists and 
warning lists. We have examples that illustrate processing activi- 
ties appear to be taking place in countries such as Malaysia and 
the Philippines. 

Once the data goes off-shore, not only do the consumers lose pro- 
tection, but at the same time U.S. law enforcement loses the ability 
to engage in legitimate law enforcement activity because the proc- 
essing is no longer within the jurisdiction of the United States. 

I would like to conclude with two recommendations for Congress 
to consider. Congress needs to restore the Fair Credit Reporting 
Act to the higher level of its original protection. And to do that, I 
would recommend, first, the elimination of the exemption for affil- 
iate sharing from the definition of consumer report or at least allow 
the partial preemption clause to sunset on January 1. Let the 
States protect their citizens and experiment on how best to protect 
their citizens. 

The second recommendation is a process issue: investigate the 
actual sharing practices of credit report information among affili- 
ated companies, and the specific uses of that data by the affiliated 
recipients that escapes the protection. This hearing is really the 
first part of this process. 

To this end, I think Congress should instruct the functional bank 
regulators and the Federal Trade Commission to investigate, audit, 
and report back exactly how organizations are using the affiliate 
sharing exemption. It is not sufficient to say a company uses the 
exemption to develop products and services or to provide better 
customer service. That does not tell us much. It does not give con- 
sumers the ability to talk with their feet and change their business 
relationships to those companies that protect their privacy. 

Thank you. 

Chairman Shelby. Thank you. Professor. 

Mr. Prill. 


STATEMENT OF RONALD A. PRILL 
FORMER PRESIDENT, TARGET FINANCIAL SERVICES 
ON BEHALF OF THE NATIONAL RETAIL FEDERATION 

Mr. Prill. Good morning, Mr. Chairman and Members of the 
Committee. 

Chairman Shelby. Put your mike in front of you. 

Mr. Prill. My name is Ronald Prill, and given the makeup of 
other Members of this Committee, I thought I should emphasize 
that my name is “Prill,” with a “P.” Until I retired about 3 weeks 
ago, I was President of Target Financial Services, and I was also 
CEO of Retailers National Bank, Target Corporation’s credit card 
bank subsidiary. I am presently employed by Target as a consult- 
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ant to our management as I transition into retirement. I appreciate 
this opportunity to speak to you today on behalf of my company, 
as well as all of the members of the National Retail Federation. 

Many retailers, like Target, have evolved, for a variety of rea- 
sons, into organizations having multiple-affiliated entities. Having 
affiliates enables us retailers to operate differentiated retail store 
formats, to operate efficiently and to be able to compete effectively. 
Besides running individual retail companies, a retailer’s individual 
affiliates might source merchandise, administer retail credit card 
programs, deliver warrantee and repair services or perform other 
functions that are necessary to the success of the retail business. 

Among Target Corporation’s affiliates are our 1,100 Target stores 
in each of the 48 contiguous States, except Vermont; Mervyn’s, our 
chain of about 250 stores, serving the middle market and located 
mostly in Western States; Marshall Field’s, 62 full-line department 
stores in 8 Midwestern States; Target. direct, our direct marketing 
and dot.com affiliate; and Retailers National Bank, which issues all 
Target, Mervyn’s, and Marshall Field’s credit cards. 

I hope you have had the opportunity to review my written testi- 
mony which I submitted to the Committee. In it, I covered, in 
detail, some of the many ways in which affiliates in a retail organi- 
zation must share information about their customers in order to 
carry out the core business functions that are dependent on that 
sharing. These core functions include things like retail credit card 
programs, controls and protections against loss from fraudulent 
merchandise returns and bad checks, and the lifeblood of a retailer, 
the capability to reach and know its customers, to communicate 
with them, and to send them advertising and targeted offers. 

My written testimony also explains how many of the benefits 
that America’s retail customers have come to expect are frequently 
possible only because of affiliate information sharing. These bene- 
fits include protection against identity theft, receiptless returns of 
merchandise, the convenience of returning or exchanging merchan- 
dise that was purchased at a retailer’s website at any of its stores 
without a trip to the post office and without paying a return ship- 
ping fee, more customer-friendly check acceptance policies and pro- 
cedures, the savings and other perks of customer loyalty programs, 
and the benefit which so many of our customers are so vocal 
about — receiving sale catalogues and other advertising at home, on 
time, and before the sale starts. 

These are all examples of truly benign sharing of information 
among affiliates whether viewed from the retailer’s perspective or 
from our customers’ perspective. Not all retailers are structured the 
same, not all have affiliates or the same number of affiliates or the 
same kinds of affiliates, but we all have pretty much the same core 
business processes and the same need to serve our customers well. 

To accomplish these things, retailers are dependent on having 
readily available information about their customers, and that avail- 
ability should be the same for all retailers and all of their cus- 
tomers, regardless of organizational structure. Our customers want 
it to be that way. 

In closing, I would like to take this opportunity to emphasize the 
retail industry’s strong support for the permanent reauthorization 
of the seven areas of preemption covered in Section 624 of the Fair 
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Credit Reporting Act. Without the extension of the Uniform 
National Standards, retailers and the customers we serve may he 
subject to a confusing patchwork of new State laws, rules, and reg- 
ulations concerning important areas such as dispute resolution and 
the information contained in credit reports. And as today’s hearing 
reflects, services that millions of customers have come to rely on 
and that they routinely take advantage of would be disrupted if in- 
formation flows are interrupted. 

Mr. Chairman and Members of the Committee, consumers have 
come to expect instant access to credit when purchasing everything 
from an automobile to furniture, appliances, and apparel. In the 
final analysis, we in the retail industry have a real concern that 
a more fragmented process for information sharing and credit ap- 
proval would negatively impact consumers in many different levels 
and, as a consequence, retail sales, ultimately costing jobs and 
hurting the economy as a whole. 

Thank you. I will be happy to answer any questions. 

Chairman Shelby. Thank you, Mr. Prill. 

Mr. Baloun. 


STATEMENT OF TERRY BALOUN 
REGIONAL PRESIDENT AND GROUP HEAD 
WELLS FARGO BANK 

Mr. Baloun. Thank you, Mr. Chairman. 

My name is Terry Baloun, and I am the Regional President and 
Group Head for Wells Fargo Banks in South Dakota, North Da- 
kota, and Montana. Thank you. Chairman Shelby and Committee 
Members for the invitation to testify and respond to your questions. 

Our Wells Fargo Banks work in concert with other Wells Fargo 
business affiliates in providing financial service products to our 
customers. The service customers expect, requires that Wells Fargo 
have integrated information systems to give customers what they 
want — when, where, and how they want it. Subject to the Fair 
Credit Reporting Act, Wells Fargo shares customer information in- 
ternally to meet these goals. 

Providing a new mortgage, providing rural or remote small busi- 
nesses with credit, offering consolidated statements for customers 
with multiple Wells Fargo products requires information about 
their financial affairs. Applying inappropriate restrictions on trans- 
fers of information among affiliates would impede customer service. 

The 1996 Amendments to the Fair Credit Reporting Act recog- 
nize the value to customers of the ability to transfer information 
among affiliates. This ability is wholly consistent with our cus- 
tomers’ expectations that their questions will be answered and 
their needs will be met with a single call or e-mail, whether their 
financial products are provided by a single company or several com- 
panies in the same affiliated group. 

In Wells Fargo’s view, it is customer expectations and needs that 
should shape public policy that regulate information use — not legal 
structure. This is especially critical to our mortgage business. Since 
passage of the 1996 Amendments to the Fair Credit Reporting Act, 
mortgage servicing has become more efficient. Wells Fargo cus- 
tomers have more channels through which they can apply for a 
mortgage and get assistance or conduct transactions related to a 
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mortgage, as well as the complete array of financial products of- 
fered by Wells Fargo. In California, 40 to 50 percent of our Wells 
Fargo mortgages originated this year are the result of referrals 
from our Wells Fargo Banks to Wells Fargo Home Mortgage. Many 
are first-time homeowners in Hispanic market areas. With affiliate 
transfers and the use of customer information, mortgage customers 
can make mortgage payments at their local branch bank, obtain 
balances, get consolidated statements, and get the support of 24- 
hour call centers that serve an entire affiliated enterprise. Our cus- 
tomers have found these services valuable. 

Sharing of customer information also benefits our small business 
customers. The basis for small business lending over the last 10 
years has been direct-mail offers of preapproved credit. Wells Fargo 
has extended nearly 500,000 small business loans since the mid- 
1990’s. FCRA allows Wells Fargo to provide such credit, based on 
Wells Fargo’s own experiences with the customer and the most cur- 
rent credit report. Generally, small businesses no longer need to 
submit tax returns or financial statements, providing easier and 
cheaper credit for the business customer. 

Actions by multiple States to enact their own State versions of 
the Fair Credit Reporting Act will frustrate customers who do rou- 
tine transactions across State lines. Wells Fargo provides services 
to thousands of customers who may have accounts domiciled in one 
State yet reside or do business with a Wells Fargo Bank in another 
State. Nearly half a million Wells Fargo customers have made tell- 
er or ATM transactions out of State within the last 5 months. In 
my banking States of South and North Dakota and Montana, near- 
ly 10 percent of Wells Fargo customers live in one State, but use 
Wells Fargo banks or ATM’s in a bordering State. 

Finally, Wells Fargo believes that the current uniform national 
standard for information use as provided by the 1996 Amendments 
to the FCRA is vital and ask that this Congress provide clarity and 
stability by removing the sunset provision that affects affiliate 
sharing and other segments of credit granting. Congress should 
also address identity theft and set new standards for notification 
about information use to customers. 

Availability of financial services, such as mortgages for our cus- 
tomers, and the flows of information required to meet those serv- 
ices available don’t stop at State borders or corporate structures. 

Thank you. I will be happy to answer any questions that you. 
Chairman Shelby, or the Committee may have. 

Chairman Shelby. Ms. Brill. 

STATEMENT OF JULIE BRILL 
ASSISTANT ATTORNEY GENERAL 
THE STATE OF VERMONT 

Ms. Brill. Thank you. Good morning. 

My name is Julie Brill. I am an Assistant Attorney General from 
the State of Vermont. Thank you very much. Chairman Shelby, 
Ranking Member Sarbanes, and other distinguished Members of 
this panel for inviting me here today. I would like to make four 
points this morning. 

The first point that I would like to make is that the economies 
of Vermont and other States with more protective laws in this area 
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of affiliate sharing and financial privacy, generally have not been 
harmed as a result of those laws. 

The second point that I would like to make is that States need 
to enact more protective laws because the Federal system for regu- 
lating affiliate sharing of information is inadequate. 

The third point that I would like to make is that States currently 
provide important protections in the affiliate sharing arena that 
are not provided in Federal law. 

The fourth point that I would like to make is that Congress 
should sunset the affiliate sharing provisions so that States can 
serve as laboratories of democracy in this arena, as Congress has 
done in so many other areas involving privacy, credit, and impor- 
tant consumer protection issues. 

With respect to my first point, the economies of Vermont and 
other States with more protective laws have not been harmed. As 
you may have heard earlier and you will certainly know by now, 
Vermont is the only State that has an affiliate sharing law that 
was grandfathered into the Fair Credit Reporting Act. That is be- 
cause we were the only State as of 1996 that had a law affecting 
affiliate sharing. 

Vermont also has more protective laws with respect to credit re- 
porting generally and also with respect to financial privacy. 
Vermont took advantage of Section 507, which was put forward by 
this Committee in the GLB enactment in order to have more pro- 
tective opt in laws with respect to third-party sharing. 

As Professor Reidenberg has demonstrated, not only has 
Vermont’s economy not been harmed but also the State economies 
in other States that have more protective laws. Those State econo- 
mies have also not been harmed. Professor Reidenberg has shown 
that our bankruptcy rates are among the lowest in the Nation, and 
our mortgage interest rates are among the lowest in the Nation. 

In addition, our office has examined auto loan rates in the States 
that have more protective laws. Vermont ranks 50th. That means 
we have among the absolute lowest auto loan rates in the country. 
California is 31st, Massachusetts is 24th. 

In addition, we examined whether credit is readily available in 
Vermont — in other words, is instant credit available? Is it available 
at very low interest rates to a broad group of consumers? 

What you see over here on the poster boards, if you can see 
them — I apologize. Senator Dole, if you cannot see them, but they 
are over there — what is over there are advertisements that 
appeared 

Chairman Shelby. Could you turn them just a little bit so that 
everybody from this angle can pick them up? 

Ms. Brill. Copies of these ads are also in my testimony. 

What these advertisements show is that credit is available in- 
stantly, at extremely low rates, to broad numbers of consumers in 
our State. We believe that an examination of advertisements in 
California and Massachusetts would demonstrate the same thing. 

So, just to refer to what Senator Johnson described with respect 
to the importance of the democratization of credit, we think the de- 
mocratization of credit is thriving in Vermont. 

With respect to my second point, the Federal laws governing af- 
filiate sharing are simply inadequate. Corporate groups are vast 
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and amorphous. We have included in my testimony lists of affiliate 
groups for three financial institutions, two of which are here this 
morning. 

Citigroup lists over 1,600 affiliates. KeyCorp, which considers 
itself a midsize bank, lists over 800 affiliates. Bank of America lists 
in official records over 1,300 affiliates. These affiliates are involved 
in a surprisingly wide variety of activities — insurance, securities, 
international banking, real estate holdings, and development. 

To answer your question. Senator Shelby — are consumers aware 
that these corporate groups are so vast and amorphous; do they un- 
derstand the information flows among these affiliate groups; do 
they have choices with respect to these information flows — I think 
the answers to these questions are: “No,” “No,” and “No.” 

Federal law provides no notice and no choice with respect to 
sharing of transaction and experience information within an affil- 
iate group or with respect to joint marketing by the affiliate group 
with respect to its joint marketing partners. It is quite simply the 
case that consumers do not expect that their Citibank account 
number will be shared with Travelers or a Citibank’s affiliates for 
marketing purposes; nor do they expect that their health informa- 
tion that Travelers may hold as a result of a property or casualty 
claim will be shared with Citibank for credit decisions. Under Fed- 
eral law — that is, if it were not for State laws protecting this kind 
of sharing of health information — that would occur. 

We believe that consumers should be notified with respect to this 
kind of affiliate sharing information when it is being used for mar- 
keting purposes or for credit decisions — that is, not for servicing 
the consumer’s original account. 

Where Federal law does provide for notice and choice — that is, 
with respect to the sharing of credit information within an affiliate 
group — the notice and choice is woefully inadequate. The same 
problems that exist with respect to GLB notices also exist with re- 
spect to the notices that go out for affiliate sharing. 

With respect to my third point. States provide important protec- 
tions in the affiliate sharing arena that are not provided by Federal 
law. GLB calls upon the States to regulate sharing of insurance in- 
formation. The National Association of Insurance Commissioners 
has created a model that requires that health information can only 
be shared within an affiliate group if the consumer consents. 

Thirty-five States have adopted this law. States also have laws 
with respect to the sharing of health information that relates to 
specific diseases such as HIV testing, cancer, or genetic testing. 
These State laws prevent life and property and casualty insurers 
from sharing this critical information with banking and other affil- 
iate groups for the making of credit decisions. The Health Insur- 
ance Portability and Accountability Act, or HIPAA, does not cover 
these financial institutions. 

In the absence of State laws, there would be no protections for 
this kind of information being used to determine whether a mort- 
gage should be granted by an affiliate of the insurance company. 

And finally, with respect to my last point, the National Associa- 
tion of Attorneys General urges Congress to allow the limited 
preemption provisions in the FCRA to sunset. This is particularly 
true with respect to the affiliate sharing preemption provision. 
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We request that Congress follow what it has done with respect 
to GLB, with respect to HIPAA, and with respect to other impor- 
tant consumer protection laws, and that is to set a Federal floor 
and allow the States to serve as laboratories of democracy as they 
have done so well in the past. 

Thank you very much. 

Chairman Shelby. Mr. Wong. 

STATEMENT OF MARTIN WONG 
GENERAL COUNSEL, GLOBAL CONSUMER GROUP 
CITIGROUP, INC. 

Mr. Wong. Good morning, Chairman Shelby, Ranking Member 
Sarbanes, and Members of the Committee. 

On behalf of Citigroup, I want to thank Chairman Shelby for 
holding these hearings on the Fair Credit Reporting Act, and I ap- 
preciate the opportunity to speak before you today to discuss how 
FCRA, and particularly the affiliate sharing provisions, impacts, 
our ability to operate efficiently and serve our over 200 million cus- 
tomer accounts. 

FCRA provides a national framework for the credit reporting sys- 
tem, which has been shown to work well and to provide substantial 
economic benefits to consumers, including affordable and conven- 
ient credit, wide credit availability, and prevention of fraud and 
identity theft. FCRA also facilitates the free flow of information 
that allows modern financial services companies to work efficiently. 

While Citigroup believes that maintaining national uniform 
standards for all seven of the expiring provisions of FCRA is cru- 
cial, I will focus my testimony on the topic of today’s hearing — in- 
formation sharing among affiliates. 

Information sharing among affiliates is an ingrained part of how 
we meet our customers’ needs and expectations on a daily basis. Af- 
filiate sharing is necessary for effective credit underwriting and 
credit monitoring which are the heart of the national credit report 
system. The sharing of information among affiliates enhances the 
ability of lenders to accurately assess credit risk, thereby reducing 
their overall risk of loss. Citigroup is able to use the credit informa- 
tion and transaction histories that we collect from our affiliates to 
create internal credit scores and models that help determine a cus- 
tomer’s eligibility for credit. This information supplements credit 
reports and FICO scores to paint the most accurate picture possible 
of a customer. For example, CitiMortgage underwriters have access 
to information from affiliates that includes a customer’s account 
balances, payment history, and available lines of credit. This allows 
our credit analysts to verify a customer’s creditworthiness quickly 
and efficiently, minimizing the burden to the customer associated 
with providing this documentation. 

Sharing information among affiliates greatly assists in the pre- 
vention and detection of identity theft and fraud. Although some 
have argued that sharing information increases opportunities for 
identity theft, our experience is that information sharing among af- 
filiates actually reduces identity theft. Through affiliate sharing, 
they are able to maintain an internal fraud database, which helps 
prevent the opening or maintenance of fraudulent accounts. This 
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kind of information sharing also allows us to alert customers to po- 
tential fraud or identity theft at an earlier stages. 

Affiliate sharing allows us to provide one-stop shopping for our 
customers in a way that is seamless and consistent with our cus- 
tomers’ expectations. Affiliate sharing allows companies like 
Citigroup to hotter service our customers’ diverse financial needs 
through affiliates that have appropriate products and services. Our 
customers want and expect the convenience of having one-stop- 
shopping for all of our products — ^banking, insurance, home mort- 
gage, credit cards, and securities. They also expect the ability to ac- 
cess information about all of their accounts in one statement, with 
one phone call, or on one website. 

Additionally, consolidated relationships allow our customers to 
move money seamlessly between accounts and to pay their 
Citibank credit card balances at any Citibank ATM, as well as, on 
the Internet, simply by making a transfer between accounts. 

Customers do not view us as different legal entities, but instead 
as a single source of multiple financial products. When a Citibank 
customer who has an account in Connecticut through our Federal 
thrift enters a Citibank branch in New York, our national bank, to 
cash a check or open another account, the customer expects to be 
recognized and receive the same level of service. The legal distinc- 
tion between the two affiliated Citibanks is not relevant to the cus- 
tomer, and it should not affect his or her ability to obtain products 
and services. 

Affiliate sharing provides the customer with pricing discounts 
and products tailored to their needs. For customers who have mul- 
tiple account relationships with us, the sharing of information be- 
tween affiliates allows us to provide financial benefits in the form 
of relationship pricing and special offers. For example, many cus- 
tomers benefit from no-fee checking through a Citibank N.A. or 
Citibank FSB based upon their total combined balances, in their 
mortgage from CitiMortgage, credit card from Citibank South Da- 
kota, and investments through Citicorp Investment Services. 

Sharing information among affiliates also permits us to service 
our customers on an individualized or tailored basis. For example, 
customers who have a Smith Barney brokerage account are eligible 
for a mortgage from CitiMortgage without a down payment by 
pledging their securities as collateral. 

In 1996, Congress struck the appropriate balance between con- 
sumer protection and business needs by allowing customers to opt 
out of having certain information shared among affiliate entities, 
but continuing to allow information about a company’s own experi- 
ences with a customer to be shared among affiliates. The FCRA na- 
tional standard is particularly reasonable now that the business of 
providing financial services, especially lending, is no longer re- 
stricted by State borders, which means that consumers have the 
same opportunities for credit, regardless of where they live. 

If different States were allowed to pass laws governing the ex- 
change of information among affiliates, it would significantly dis- 
rupt our seamless, nationwide system of serving our customers. It 
could lead to a never-ending process as States and localities impose 
different regimes. Compliance with this patchwork of laws would 
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be extremely burdensome and costly for lenders, and ultimately for 
consumers. 

Thank you for the opportunity to appear before this Committee. 

Chairman Shelby. Mr. Mierzwinski. 

STATEMENT OF EDMUND MIERZWINSKI 
DIRECTOR, CONSUMER PROGRAM 
U.S. PUBLIC INTEREST RESEARCH GROUP 

Mr. Mierzwinski. Thank you, Mr. Chairman and Senator Sar- 
banes. I also want to recognize Senator Allard, who has been a 
sponsor of important legislation on the transparency of credit 
scores in the past, and Senator Running, for his important con- 
tributions on Social Security Number protection in the past. These 
are important privacy bills that I hope the Committee will move on 
as well. 

The U.S. Public Interest Research Group is pleased to testify 
again on the important matter of affiliate sharing and the Fair 
Credit Reporting Act. In 1970, Congress passed a comprehensive 
statute to regulate the use of credit reports. It gave these third- 
party companies, credit reporting agencies, tremendous ability to 
collect and disseminate comprehensive dossiers on individual con- 
sumers and to sell them onto the market. That Fair Credit Report- 
ing Act since 1970 has served a very important purpose. It is a 
very important law despite the problems that we have with it. But 
the important thing about the Fair Credit Reporting Act is that it 
regulated the use of those credit reports. It gave consumers com- 
prehensive rights. When your credit report was used for an adverse 
action, you gained the right to learn that it had been used for an 
adverse action — the right to look at, the right to dispute, the right 
to correct, and then the right to enforce all of those rights if they 
would not correct your report. 

In 1996, when Congress amended the Fair Credit Reporting Act 
to deal with a number of problems in the Act, industry insisted on 
a “stealth” amendment to the Act. I was there. Assistant Attorney 
General Brill was there 

Chairman Shelby. Explain “stealth” amendment. 

Mr. Mierzwinski. I am unaware that Congress held any hear- 
ings, Senator, as this hearing is being held today, on the issue of 
affiliate sharing. I am unaware of any record testimony on why in- 
dustry needed an exception to the definition of “credit report” for 
affiliate sharing. 

There was one big markup in the House Banking Committee at 
the time where it was debated extensively, but we lost — industry 
had the horses, they had the votes — ^but really, the Federal Trade 
Commission, consumer groups, the attorneys general, NAAG, we 
all opposed this, and we thought there would be significant prob- 
lems posed by creating an exception. And as Professor Reidenberg 
has pointed out, under the affiliate sharing regime, information col- 
lected by affiliates becomes exempt from the Fair Credit Reporting 
Act. It is not regulated in any meaningful way, if at all, by the Fair 
Credit Reporting Act, and it is not regulated by the Gramm-Leach- 
Bliley Act. 

The Gramm-Leach-Bliley Act was passed in 1999. It has Title V, 
a private title, and Title V simply says that if you provide notice 
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of your affiliate sharing practices, your information practices, you 
have the right to do whatever you want within your affiliates and 
even with, as Assistant Attorney General Brill pointed out, some 
third parties who are treated as if they are part of your corporate 
family. 

You do have a limited right to opt out of the sharing of your com- 
prehensive experience and transaction information only if it is 
going to be shared with telemarketers who are selling nonfinancial 
products. 

Now, as Mr. Wong pointed out, the biggest companies — the ones 
with hundreds or thousands of affiliates — are able to develop data- 
bases of information that has been laundered outside the protection 
of the Fair Credit Reporting Act. Even credit reports, not just the 
experience information, but credit reports and information from 
your applications, information from your references, can also be col- 
lected in these corporate entities, although that so-called “other” in- 
formation, as opposed to the experience information, is subject to 
an opt out. They can use that information to create an unregulated 
in-house credit bureau. 

Chairman Shelby. How widespread is that? 

Mr. Mierzwinski. I think the biggest companies have the biggest 
databases. I think they are all doing it. We talk about this as a pri- 
vacy issue. Senator, but really, the potential is that it is a con- 
sumer protection issue. And I cannot stress enough that when we 
have unregulated use of affiliate information, consumers do not 
gain the comprehensive bundle of rights that they gain under the 
Fair Credit Reporting Act. 

In the debate that has occurred over the continuation or exten- 
sion — what industry calls “reauthorization” — of the temporary pre- 
emption amendments, I think there has been a lot of misleading 
information out there. 

First, of course, the notion that industry is for opt out, and con- 
sumers are for a harsh opt in — industry is actually for no opt. That 
is what we have under Gramm-Leach-Bliley, is no opt, and that is 
what they vastly prefer — no choice for consumers. 

Second, this representation that information sharing will come to 
a grinding halt if we give consumers privacy rights is fallacious as 
well. Gramm-Leach-Bliley provides a number of exceptions for un- 
derwriting, for fraud control, for the public safety, for completing 
a consumer’s own account requests. You can have a call center 
even with financial privacy. You can have multiple accounts with 
one database even with financial privacy. It is just flat-out wrong 
to claim that if consumers have the right to control their informa- 
tion for secondary purposes, all information would grind to a halt, 
and we would be living in caves. 

That is basically the summary of my testimony. I know I have 
run out of time. There is a lot more in my testimony. I also want 
to point out my House testimony from 2 weeks ago goes into great 
detail about other problems with the Fair Credit Reporting Act. 

I want to say finally, of course, that the Sarbanes Amendment 
to the Gramm-Leach-Bliley Act is a very critical amendment. That 
is the amendment that was added in conference that allowed the 
States to enact stronger financial privacy laws; and California is 
considering a stronger law. California’s champion, Jackie Spear, 
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has compromised with the industry, yet the industry still opposes 
her bill. She has even agreed that industry could have some infor- 
mation kept in no opt silos, other information would be under an 
opt out, some third-party sharing would be under an opt out, and 
some would be under an opt in. She has compromised, yet industry 
still opposes her reasonable bill. Consumers Union, CalPERG, and 
other groups are prepared to go to the ballot. 

But I think it is important that this Committee look at what in- 
dustry is doing to chill efforts by other States around the country 
to emulate what California is trying to do by claiming that the 
Gramm-Leach-Bliley Act’s preservation of the Fair Credit Report- 
ing Act trumps the explicit provision giving States greater financial 
privacy rights. We think that that is wrong. We think that the Fair 
Credit Reporting Act’s exception simply says that they are not a 
credit bureau when they share information. We do not like that, 
but it should not go any further than that. 

I want to conclude by saying that we would appreciate the Com- 
mittee continuing its detailed deliberations on this issue and to 
consider this — if you extend the preemption and take away States’ 
rights forever, it would be very difficult for the States, who are 
more nimble, to find local problems, identify them, and react to 
them quickly, as Vermont did, as Massachusetts did, as California 
did, before Congress ever acted in 1996. 

Remember that last year, even Enron was not enough to guar- 
antee passage of the corporate reform bill. Sarbanes-Oxley legisla- 
tion was only passed after Worldcom came to our door as well. 

Thank you very much. 

Chairman Shelby. Ms. Maynard. 

STATEMENT OF ANGELA L. MAYNARD 
CHIEF PRIVACY EXECUTIVE AND COUNSEL, KEYCORP 
ON BEHALF OF THE FINANCIAL SERVICES ROUNDTABLE 

Ms. Maynard. Mr. Chairman and Members of the Committee, 
my name is Angela Maynard, and I am the Chief Privacy Executive 
and Counsel for KeyCorp, or Key, an $86 billion financial services 
company headquartered in Cleveland, Ohio. Key is a member of the 
Financial Services Roundtable, and I am appearing on behalf of the 
Roundtable today, as well as the customers, employees, and share- 
holders of Key. 

I appreciate the opportunity to testify before the Committee on 
the role of affiliate sharing under the Fair Credit Reporting Act. 
FCRA is central to our national credit system. 

The Roundtable and Key support the affiliate sharing provisions 
of FCRA, and we urge the Committee to renew the provisions of 
FCRA that are scheduled to expire. 

The Roundtable has found that failure to renew key provisions 
of FCRA will result in higher credit costs for consumers, decreased 
credit availability for those least advantaged, and reduced cus- 
tomer spending. 

The Roundtable has found that the customers of its member com- 
panies have saved an estimated $8 billion as a result of informa- 
tion sharing within affiliates. Moreover, the Roundtable has found 
that contrary to common perception, targeted marketing reduces 
the number of solicitations consumers receive. 
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Like many other financial services companies, Key owns a num- 
ber of subsidiary companies, all of which qualify as affiliates for 
purposes of FCRA. However, less than 20 companies that Key owns 
provide products and services directly to consumers. Moreover, we 
have diligently tried to reduce this number, and it is only due to 
regulatory and tax laws that we continue to operate with multiple 
affiliates. 

To our customers, however. Key is not a collection of separate 
companies. It is a single entity that offers a variety of financial 
products and services. Key uses the affiliate sharing provisions of 
FCRA in many ways that help consumers. 

Affiliate information sharing permits us to provide products and 
services that meet specific needs of our customers. To do this, we 
must understand a consumer’s financial needs and financial profile. 
Affiliate sharing allows us to gather that data. Once we have an 
understanding of our customers’ needs and financial profile, we can 
determine what products and services are the best fit for that cus- 
tomer. 

Affiliate sharing allows us to deliver financial products and serv- 
ices efficiently. It eliminates the need for customers to deal sepa- 
rately with different Key employees at different locations. Affiliate 
sharing accelerates account application and approval procedures. 
When we can use existing customer information that is maintained 
by a Key company, we can reduce the need for a customer to spend 
time gathering papers and finding information necessary to com- 
plete an application. Using existing customer information also en- 
ables us to accelerate our review process. 

Key offers several products that straddle affiliates. For example. 
Key’s Total Access Account connects a brokerage account with a 
bank deposit account. Customer information must be shared 
between our brokerage and our bank to allow this and similar 
cross-affiliate products to coexist. Combined statements and online 
account aggregation services are other examples of services that 
are a direct result of affiliate sharing. 

Key uses affiliate sharing to maintain and grow customer rela- 
tionships. One way we achieve this is through relationship-based 
pricing and discounts for customers who maintain multiple ac- 
counts across Key. Affiliate sharing allows Key to determine which 
customers qualify for discounts and other pricing breaks. 

Affiliate sharing helps us to respond to customer inquiries and 
to update customer information. With access to shared information, 
a single Key employee can assist a customer with almost any re- 
quest. This saves the customer the time and nuisance of separate 
visits and multiple telephone calls. Affiliate sharing also helps Key 
manage data quality across the organization, and maintaining the 
accuracy of customer information is critical in our fight against 
identity theft. 

Centralized functions — such as call centers, operations centers, 
analytics, and product development — all require information shar- 
ing across affiliates. Consolidating functions improves expertise, al- 
lows us to better manage risks, and significantly reduces operating 
expenses. These benefits are passed on to the customer in the form 
of better service and lower costs. 
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In order to ensure that our marketing efforts benefit our cus- 
tomers, we use affiliate sharing to understand our customers’ 
needs. We do not market products to consumers who have re- 
quested us not to solicit them. 

Information sharing among affiliates is critical in our efforts to 
fight fraud. Gathering and sharing information on the accounts 
across the organization is the only means to effectively address this 
serious problem. Having access to information across affiliates in- 
creases the speed with which Key can assist a victim of fraud and 
identity theft. 

Finally, affiliate sharing is a critical component to Key’s compli- 
ance efforts with antimoney laundering laws. 

In conclusion, the Roundtable and Key support the affiliate shar- 
ing provisions of FCRA. We firmly believe that the statute strikes 
an appropriate balance between consumer protection and corporate 
structure, and we urge the Committee to make the existing provi- 
sions of FCRA permanent and thereby reaffirm our national credit 
system. 

Chairman Shelby. Thank you very much. 

As an initial matter, I think it is worth noting that many of the 
information sharing practices that have been identified here today 
by the witnesses from the financial service firms are, in fact, prac- 
tices that I believe have statutory authority to conduct independent 
of the Fair Credit Reporting Act. 

For example, doesn’t Gramm-Leach-Bliley authorize information 
sharing, for example, to combat identity theft or customer request, 
among many others, and if this is the case, can some of you from 
the financial service industry help us understand why the Fair 
Credit Reporting Act affiliate sharing provisions are so important? 

Mr. Wong. 

Mr. Wong. Senator, I believe that the Gramm-Leach-Bliley law 
does deal with sharing of information but more in the context of 
third parties and not affiliate sharing. 

The FCRA is important because it deals with affiliate sharing of 
information, information that is needed for us to render services, 
products, to a customer in the manner that he or she expects. 

Chairman Shelby. Mr. Baloun. 

Mr. Baloun. Mr. Chairman, I am not an expert in the compli- 
ance area, but my understanding is that the Fair Credit Reporting 
Act allows affiliate sharing explicitly for financial institutions as 
Wells Fargo which is not a credit bureau. There is a tremendous 
investment that we make in gathering the information, and if we 
segregate that, I do not think we could spend the amount of money 
and the technology that we do to gather it all. 

FCRA allows us to use that technology to give more information 
to our customers; so we get to leverage it in additional sales and 
additional opportunities for our customers along with notification. 
That would be my interpretation. 

Chairman Shelby. Thank you. 

Ms. Brill, of the seven preemption provisions up for reauthoriza- 
tion, six involve, I believe, substantive national standards. I would 
like to review just briefly the standard in terms of the rules regard- 
ing affiliate sharing. 

Could you explain the standard again? 
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Ms. Brill. Thank you. Yes, I will try the hest I can. 

It is a confusing standard. 

Chairman Shelby. First, what are the practical differences be- 
tween what we call “experience” and “nonexperience” information? 

Ms. Brill. First of all, the standard is contained in a definition 
that excludes from the definition of “consumer reports” certain 
types of information. As was pointed out by Mr. Mierzwinski, there 
were no Congressional hearings of which I am aware that went 
into really what this exclusion to the definition actually meant. 

Chairman Shelby. Some of us have been on the Committee for 
a long time. I have been here for 17 years, and Senator Sarbanes 
has been longer than I have. I do not remember any hearings, do 
you? 

Senator Sarbanes. No. 

Chairman Shelby. Okay. Go ahead. 

Ms. Brill. Okay. So our research was accurate. We were not 
able to find any. 

So it is unclear — there is not a lot of work out there by the Con- 
gress to help us understand what these words mean, so we are left 
with the actual words in the statute. 

What the statute provides is that information that is known as, 
“transaction and experience information,” which I will describe in 
a second, is automatically excluded from the definition of a “con- 
sumer report.” Other information which the Federal regulatory 
agencies including the OCC have defined as basically credit-related 
information is excluded from the definition of “consumer report” 
but only if financial institutions provide an opt out. That is more 
or less what it is. 

Now, the difference between transaction and experience and 
other information is that “transaction and experience information” 
include not only your account balance on your credit card, your 
payment history, and things like that, but it even goes into what 
you are actually purchasing. I believe that financial institutions 
and other retailers are collecting and mining the information about 
your actual purchases. That is transaction and experience informa- 
tion. In other words, it is information that the financial institution 
holds as a result of having an account with you. 

In contradistinction, the other information for which the finan- 
cial institutions have to give a notice and opt out is information 
they obtain from third parties. Primarily and foremost among that 
is credit reporting information. Also, it is information that they 
might have as a result of an employment investigation if they are 
going to hire you; that information is also considered other infor- 
mation. 

Have I answered your question? 

Chairman Shelby. You have. 

Mr. Mierzwinski, do you want to comment on that briefly? 

Mr. Mierzwinski. I would agree with all of that, and just to re- 
state what I said earlier, the definitions create these as exceptions. 
They really actually do not provide a scheme of regulation. And 
even though there is an opt out for the other information, as the 
professor pointed out earlier, if Affiliate 1 obtains your credit re- 
port and uses it for an adverse action, it must provide you with an 
adverse action notice. However, if Affiliate 1 shares your credit re- 
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port — if you had not opted out, if you did not understand the opt 
out 

Chairman Shelby. Does this distinction make sense to you? 

Mr. Mierzwinski. They get the credit report totally clean of any 
consumer rights if they give it to Affiliate 2. 

Chairman Shelby. Senator Sarbanes. 

Senator Sarbanes. Thank you very much, Mr. Chairman. 

This has obviously been a very interesting panel, and we appre- 
ciate the participation by the various panelists. This is an issue 
with some complexity and some great importance. 

Professor Reidenberg, I would like to ask you first — I want to 
make sure I understand this — is it the case that under the current 
system, if the data moves from the main enterprise to whom the 
consumer provides it to an affiliate, that affiliate then is free of 
some of the limitations or protections that apply to the data as far 
as its receipt by the main enterprise? 

Mr. Reidenberg. I believe that is correct. There would be one ca- 
veat to it. Take the case, for example, that I fill out a credit appli- 
cation that includes all sorts of financial data and other data about 
me, and I am given credit by the grantor. Ordinarily under the 
definitions, my application would have to be treated as a “consumer 
report” by the credit grantor. If that company shares my loan ap- 
plication data with an affiliate, the definition in Section 603 of af- 
filiate sharing says that the credit grantor does not have to comply 
with all the protections in the statute to share the data with the 
affiliate. 

So if the affiliate wants to use the data for just general mar- 
keting purposes — a use that ordinarily would be prohibited — the af- 
filiate at that point — who acquired the personal information for 
marketing purposes — can do whatever it wants with the data. None 
of the protections apply. 

Senator Sarbanes. Whereas the enterprise that I provided it to 
to begin with could not; is that correct? 

Mr. Reidenberg. That is correct. 

Senator Sarbanes. All right. I just wanted to be clear on that. 

Mr. Reidenberg. There is one caveat that is important to recog- 
nize. If the affiliate acquired the data for credit decisions, then 
what the affiliate could then do with respect to third parties, unaf- 
filiated companies, might come back within some of the protections 
of the statute. It is the initial transfer from Company 1 to Com- 
pany 2 that is exempted under the definition. 

Senator Sarbanes. I want to be very clear about this. I am the 
consumer. I provide the information to Company 1. There are limi- 
tations on what Company 1 can do with it. 

Mr. Reidenberg. Correct. 

Senator Sarbanes. Company 1 then provides it to Company 2 
which is an affiliate, and Company 2 is then free of those limita- 
tions, or at least some of those limitations. Is that correct? 

Mr. Reidenberg. By and large, that is correct; they are free of 
most of the limitations. 

Senator Sarbanes. Well, I have difficulty seeing the rationale for 
that, but I will defer because I have a number of other questions 
I want to ask, and my time is very short. 
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Attorney General Brill, I would like to ask you — the Partnership 
to Protect Consumer Credit is running ads — presumably, you have 
seen them. I understand that the Partnership to Protect Consumer 
Credit — a lot of work goes into picking the names of these groups — 
but I gather the National Retail Federation played a part in that; 
is that right, Mr. Prill? 

Mr. Prill. I do not know — yes. 

Senator Sarbanes. Yes. In this ad, they have a house with red 
tape all over it, and they say: “Without a national consumer credit 
system, a new home could be a lot harder to move into.” And then, 
they say it is going to be a bureaucratic nightmare of red tape with 
these States laws, and “As a result, many Americans would face 
costly delays in purchasing a home, financing a car, or buying a 
big-ticket item.” 

Now, of course, Vermont is able, with the grandfather clause, to 
provide extra protections. Have Vermonters encountered these cost- 
ly delays referred to here in purchasing a home, financing a car, 
or buying a big-ticket item? 

Ms. Brill. No, absolutely not. Credit is very widely available in 
Vermont and at extremely low rates. Instant credit is available. We 
are able to go to ATM’s across the Nation and obtain cash. We are 
able to obtain free checking 

Senator Sarbanes. That is enough; I have got to keep moving be- 
cause my time 

Ms. Brill. Sorry. The answer to your question is no. 

Senator Sarbanes. Mr. Baloun, Wells Fargo’s privacy policy 
states — this is off the Internet — “You have choices regarding how 
information about you is shared. If you would like to opt out of in- 
formation sharing with outside financial companies and/or within 
the Wells Fargo family, your preferences will be honored and will 
apply to all accounts linked to your Social Security Number. If you 
choose to opt out of information sharing, please call the toll-free 
number that appears at the end of this disclosure.” 

I gather that that obviously means you permit your customers to 
opt out of affiliate sharing; is that correct? 

Mr. Baloun. That is correct. Senator. 

Senator Sarbanes. If so, what problem would you have with the 
right of consumers to opt out of affiliate sharing under the Federal 
Credit Reporting Act? I take it it would not be a problem for you; 
it would only open up an opportunity for consumers who deal with 
institutions that do not provide this kind of privacy power. Would 
that be correct? 

Mr. Baloun. Senator, we grant our customers — at the time that 
an account is open, an opt out option and give them the materials. 
Then, we have set up the 800-number where they can contact — 
and let me go a step further. Once a year, we mail to our customers 
another notification, again giving them the opportunity to do a sim- 
ple tear-off sheet if they want to opt out. 

Now, as a businessperson dealing with my three regions, we do 
talk with our customers and talk to them about the advantages of 
not opting out so we can share information with them. There are 
times when we may have mortgage products or something that is 
advantageous, and we will call our customers and talk to them 
about that, where they will actually end up getting cheaper rates 
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or better deals. We cannot do that if they opt out. If they opt out, 
they have the right to do that, but we do not encourage them to 
because I can serve my customers better by being able to commu- 
nicate with them — ^but they have the right. 

Senator Sarbanes. Do you think, generally speaking, that con- 
sumers should have this option that Wells Fargo offers to them? 

Mr. Baloun. It works for us. I do not really have a position for 
the industry. 

Senator Sarbanes. Let me very quickly ask Mr. Wong — you work 
in Europe and elsewhere, internationally, right? 

Mr. Wong. Yes, sir. We operate in over 100 countries. 

Senator Sarbanes. And you have to abide by the privacy provi- 
sions that apply in the European Union with respect to consumers 
there, do you not? 

Mr. Wong. Yes, sir, we do. 

Senator Sarbanes. Those privacy provisions are significantly 
more protective of the consumers’ information than what exists in 
this country; would you say that that is generally the case? 

Mr. Wong. With some caveats. Senator. 

Senator Sarbanes. But you have been able to do business under 
those requirements. 

Mr. Wong. That is correct. 

Senator Sarbanes. Why does providing additional protections for 
consumers in this country seem to cause you so much concern? If 
you provide it over there so a European gets better protection, and 
if you can work, apparently, profitably and so forth under that cir- 
cumstance, why does this create a problem for you? 

Mr. Wong. Senator, as I understand the European model, which 
people have described as an opt in model, the way it works is that 
if you are applying for credit, and should the lender offer you cred- 
it, the lender will condition the offer of that credit with you opting 
in to sharing of information. So the majority of customers seeking 
to obtain those products from that lender would in essence be opt- 
ing in and therefore agreeing to sharing of that information. 

Senator Sarbanes. I have run over my time, and I know that 
Senator Bennett wants to ask some questions, and we have a vote. 

Chairman Shelby. Thank you. Senator Sarbanes. 

Senator Bennett. 

Senator Bennett. Have any of you ever applied for a home mort- 
gage in a different State from the one in which you were previously 
employed prior to the passage of the Fair Credit Reporting Act? I 
have. It applies — I am sorry — to the red tape involved in the ad. 

It took me a month, moving from California to Utah, prior to the 
information sharing, even though I was dealing with the same 
bank, as they went through all of the red tape and all the rest of 
it. It was a nightmare. I got the home mortgage, I got the thing 
done, but I would be delighted to have had my bank in California 
to be able to tell the bank in Utah, “We know this man; he is legiti- 
mate; his income is proper.” I would have been thrilled with that 
experience. 

Is there any connection. Prill and Brill, with Vermont’s position 
and the fact that that is the only State where you do not have a 
Target store — or is it pure coincidence? Just a quick “yes” or “no.” 

Mr. Prill. Senator, there are probably several factors there. 
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Ms. Brill. I would say it has more to do with our environmental 
laws than anything, probably. 

Senator Bennett. Never mind. I do not want to get into that. I 
just thought it was very interesting that you were operating every- 
where but Vermont, and Vermont talks about the grandfathered 
situation. 

Senator Sarbanes. Is it because of this privacy issue? 

Mr. Prill. No, Senator Sarbanes, I am not saying that. It is to 
that extent a coincidence, but we have no plans to build in 
Vermont, either. 

Senator Sarbanes. All right. 

Senator Bennett. All right. Well, the time is gone, and let me 
just share with you my reactions. 

Professor Reidenberg, you said “We do not know.” You gave us 
a lot of potentially difficult situations, and then you said “We do 
not know.” And the industry witnesses gave us concrete examples 
of things they had been able to do that had been better for the cus- 
tomer. 

My question would be this: Can anybody give me — among those 
who are opposing the extension of the affiliate provision — a con- 
crete example, other than a single anecdote, that is, that can be 
quantified into some kind of analysis of how there has been definite 
consumer damage, because we have gotten concrete examples from 
the industry of consumer benefits. The consumer benefits have 
been fairly consistent between the different institutions, and we 
have a concrete number of the amount of money that has been 
saved by virtue of the affiliate sharing — money which I presume in 
today’s economic environment translates into lower consumer costs, 
because pricing power is very much absent in the present economy. 

So if companies are saving in the billions of dollars — and it can 
be documented — I assume you would not have put it in your testi- 
mony if it could not have been — companies are saving in the bil- 
lions of dollars, and that is being translated into lower consumer 
costs by virtue of competitive pressures that says when you have 
that kind of savings, you pass it on competitively to try to get peo- 
ple to be with you rather than with your competition — if we have 
all of these documented benefits which consumers like — as I said, 
from my personal experience, I certainly would have liked getting 
that mortgage — can we get any concrete examples from the oppo- 
nents of how consumers have been damaged? 

I have heard very careful legal arguments of things that could 
happen, but I have not heard any examples of things that have 
happened or people who have been damaged. And we have to run 
off to a vote, but if you could supply that for the record, I assure 
you I will read it very carefully. But that is where I come down 
on this. 

Chairman Shelby. And we will all read it if they will supply any 
of these answers. 

Senator Bennett. Yes. That is where I come down on this. It 
strikes me as a theoretical argument of this is what could happen 
and that could be bad versus this is 6 years of experience of things 
we have done that have been good. And my own background leads 
me to go with that which has happened rather than that which 
could happen. 
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Thank you. 

Chairman Shelby. We have three stacked votes; that means we 
are going to have to accelerate this. 

Senator Sarbanes. 

Senator Sarbanes. Thank you very much, Mr. Chairman. I will 
be very brief, because I know the votes are pressing. 

In the course of responding to the question that Senator Bennett 
just asked, Mr. Baloun, I would particularly appreciate it if you 
would focus on the following situation. 

The Association of Community Organizations for Reform Now 
has written to Comptroller Hawke at the Currency about predatory 
lending issues involving Wells Fargo. In that letter, they say: “We 
have seen various examples of referrals and other similar connec- 
tions back and forth between the institutions embracing the affil- 
iate institutions, unfortunately not in the direction of assuring A 
credit for A borrowers. One borrower family we know, for example, 
long-time customers of Wells Fargo Bank, went into a Wells Bank 
branch looking to refinance their home loan. After they provided 
the loan officer with information about themselves” — and appar- 
ently, the loan officer talked about a loan at about 5 percent and 
without closing costs — “they then got a call back from Wells Fargo 
Financial” — which I understand is your subprime lender; is that 
correct? 

Mr. Baloun. That is correct. They do make subprime loans. 

Senator Sarbanes. Yes. They are your subprime lending unit as 
I understand it. 

And contrary to these terms that at least had been put out to 
them originally as real possibilities, they ended up at a variable 
rate at 9 V 2 percent and closing costs of 4 percent of their lender. 

Now, obviously, the information that came in to the bank then 
went out to the subprime lending affiliate subsidiary at Wells 
Fargo, and they then got in touch with these people. 

Could you look into that situation in the course of responding to 
the question that Senator Bennett put to you? 

Mr. Baloun. Yes. 

Senator Sarbanes. Thank you, Mr. Chairman. 

Chairman Shelby. Thank you. 

As I told you, we have three stacked votes, and it will take an 
hour or so before it is over, but I have a number of questions for 
the record, and other Members who were not here and in other 
hearings probably will. This has been a very interesting panel 
today, and I hope you would respond to those. I just want to touch 
on a few of them, but we will submit them. 

I’d be interested — I know you do not have time to answer this 
now — in what level of understanding does the average consumer 
have with respect to affiliate sharing? I think that’s important. 
Does the number of affiliates a firm has affect this understanding? 

What about situations where the affiliates are engaged in en- 
tirely different lines of business? In other words, does it matter 
that a person recognizes that they have a relationship with a bank 
but may not know that the bank also owns a retail securities bro- 
kerage firm or a direct-mail operation where this information 
would be used, and other things? 
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How important is a firm’s brand to consumers in establishing 
their expectations with respect to the kind of relationship that they 
have with a company? How important is that brand? Should there 
be safeguards or best practices for sharing information within 
affiliates? 

Of course, I am also interested — and I think the Committee is for 
the record — that while called “affiliate sharing provisions,” some of 
these provisions actually allow companies to share information 
with entities that are outside their affiliate structures. Why is this 
necessary, and does it actually make sense? And do consumers 
have diferent concerns with respect to affiliate sharing versus 
third-party sharing? 

Should there be greater control over sharing information outside 
an affiliate structure than within an affiliate structure? In other 
words, should this provision be limited so that the only type of in- 
formation sharing permitted is sharing with affiliate entities and 
so forth? 

We are going to submit other questions to you. 

Chairman Shelby. We appreciate very much you coming today 
and preparing. This is a very important piece of legislation. 

Thank you very much. 

[Whereupon, at 11:48 a.m., the hearing was adjourned.] 

[Prepared statements, response to written questions, and addi- 
tional material supplied for the record follow:] 
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PREPARED STATEMENT OF SENATOR JIM RUNNING 

Thank you, Mr. Chairman, for holding this very important hearing and I would 
like to thank our witnesses for testifying today. This is the third in a series of hear- 
ings on the Fair Credit Reauthorization Act. As we all know, the FCRA is a impor- 
tant issue for the financial industry and to consumers. There are differing opinions 
on the direction the FCRA should take. There are some who think we need to pass 
the FCRA with no changes, some who think we should pass the FCRA but with ad- 
ditional privacy and identity theft protections and some who think privacy decisions 
would be better left to the States. These hearings will be a great help to Members 
in deciding which is the best way to go. 

Affiliate sharing was something we addressed extensively during Gramm-Leach- 
Bliley and it seems to still be a point of contention. There are many questions being 
asked. Do consumers benefit from the flow of information between affiliates, or are 
there too many risks with this practice to warrant it? Is an “opt in” plan better than 
the current “opt out” program? Are the privacy statements too long and do they con- 
tain too much legalese? Or are consumers simply throwing the privacy notices out? 
What responsibilities do consumers have to keep themselves informed of the infor- 
mation sharing policies of the companies they do business with? What are the unin- 
tended consequences of legislation to change the current affiliate sharing status 
quo? I am looking forward to hearing these issues be hashed out. 

But I have another concern. I am very concerned about this economy. I am very 
worried about the possibility of a double-dip recession. I know that puts me at odds 
with more optimistic economic minds, like Chairman Greenspan, but contrary to 
popular belief. Chairman Greenspan is not always right. In fact, I think his decision 
to lower the prime interest rate yesterday by a quarter point was not nearly aggres- 
sive enough. He should have lowered the rate by a half point to further give the 
economy the shot in the arm it needs. Right now, the economy is just not where 
it should be, we are not growing like we can, and we are not creating jobs. 

If there is one thing that shakes the markets, it is uncertainty. I am afraid that 
the talk of not renewing the FCRA is creating a lot of uncertainty in the financial 
markets. If we have 50 different privacy standards, it will be difficult for financial 
companies to sell their products nationwide. If counties and municipalities get in the 
act, and some already have, it will be even more difficult. In this economic climate 
we need to promote a uniform standard for consumer reporting and not add more 
confusion and chaos. 

It is crucial we pass an FCRA extension this year. We must bring some certainty 
back to the markets if we are ever going to get this economy to grow and prevent 
a double-dip. 

Again, Mr. Chairman, thank you for holding this important oversight hearing. 
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Professor of Law, Fordham University School of Law 

June 26, 2003 

Mr. Chairman, Ranking Member, and distinguished Members of the Committee, 
I commend you for convening this hearing on affiliate sharing practices and their 
relationship to the Fair Credit Reporting Act and I thank you for the honor and 
privilege to appear before you. My name is Joel R. Reidenberg. I am a Professor of 
Law at Fordham University School of Law where I teach courses in information pri- 
vacy, international trade, and comparative law. As a law professor, I have written 
and lectured extensively on the regulation of fair information practices in the pri- 
vate sector. My bibliography includes scholarly articles and two co-authored books 
on data privacy. Of relevance to today’s hearing, I have studied and written about 
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the Fair Credit Reporting Act (FCRA) and have advised both Federal and State 
Government agencies on FCRA litigation issues. I am a former Chair of the Associa- 
tion of American Law School’s Section on Defamation and Privacy and have served 
as an expert advisor on data privacy issues to State and local governments, to the 
Office of Technology Assessment in the 103rd and 104th U.S. Congresses and, at 
the international level, to the European Commission and foreign data protection 
agencies. I appear today as an academic expert on data privacy law and policy and 
do not represent any organization or institution which I am or have been affiliated. 

My testimony will focus on three points: (1) the U.S. credit reporting system needs 
strong privacy protections to preserve a robust national information economy; (2) 
the affiliate sharing provisions of the 1996 Amendments create significant unrecog- 
nized loopholes that eviscerate the protections of the FCRA; and (3) the affiliate 
sharing loopholes pose that security risks and a threat to the soundness of the U.S. 
credit reporting system. 

I recommend that Congress either eliminate the affiliate sharing loopholes or 
leave the 1996 sunset clauses alone so that States are reauthorized to protect their 
citizens against abusive practices under the affiliate sharing loopholes. I further rec- 
ommend that, before taking any other type of legislative action. Congress should in- 
vestigate thoroughly these broader implications of affiliate sharing. Congress must 
have a much deeper factual knowledge of the specific types of credit report data that 
is shared among affiliated companies and a much deeper knowledge of the specific 
uses, disclosures, and onward transfers that are made by the affiliated recipients 
outside the protections of the FCRA for citizens’ privacy. 

Strong Privacy Protections are Essential for the Credit Reporting System 

The FCRA was enacted in 1970 as a response to significant abuses in the nascent 
credit reporting industry. Decisions affecting citizens’ lives were being made in se- 
cret with bad data. Congress heard extensive testimony during the late 1960’s on 
the unfair and abusive information practices that voluntary industry guidelines 
failed to prevent. These included the release of credit information to noncredit 
grantors, the dissemination of inaccurate credit information, the inability of con- 
sumers to gain access to their credit reports, and the difficulty of consumers to ob- 
tain correction of erroneous information.^ Scandals and distrust were harming the 
marketplace. 

In enacting the original FCRA, Congress wanted to assure the efficiency and in- 
tegrity of the U.S. banking system. The statute became the cornerstone of U.S. pri- 
vacy law. Congress recognized fair information practices were essential for vibrant 
credit markets and expressly sought, “to prevent an undue invasion of the individ- 
ual’s right of privacy in the collection and dissemination of credit information.” ^ 

The FCRA Established the Principles of Opt In Consent and the Fair Treatment of 
Personal Information 

At the time of enactment, the FCRA was an extraordinary and unique statute 
precisely because the law set a new standard for strong privacy protection. The 
FCRA established a then-novel system of opt in permission for the dissemination 
of credit report information. The statute defined a specific set of permissible pur- 
poses for which the disclosure of credit report information was authorized. These 
purposes related directly to the reasons for which collected data was gathered and 
were generally limited to the extension of credit, insurance, or employment. Any 
other disclosure of credit report information required the written consent of the con- 
sumer. 

Among other important innovations for fairness, the law created transparency in 
the industry by granting a consumer the right of access to credit report information 
and by requiring the industry to identify the recipients of credit reports. The law 
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further provided rights for consumers to dispute inaccurate information contained 
in their credit reports. Finally, the FCRA included due process safeguards before a 
consumer reporting agency could disclosure credit report information to Government 
agencies or law enforcement. This overall framework provided a bedrock set of 
standards for fair information practices. 

The FCRA Never Created an Overall “Uniform National Standard” 

From the start, however. Congress recognized that the credit reporting industry 
would be likely to evolve significantly and that even greater privacy and fairness 
could benefit the banking industry. As a result. Congress permitted the States to 
enact stronger privacy protections for credit reporting since stronger State statutes 
promoted the main goals of the orimnal FCRA. In fact, at the time of enactment, 
this Committee specifically endorsed the position of State officials who testified at 
Senate hearings expressing, “a need for Federal legislation to supplement any fu- 
ture State legislation which may be enacted.” 

The major subsequent fair information practice laws similarly adopted this policy 
and waived Federal preemption. For example, the Financial Services Modernization 
Act, the Health Insurance Portability and Accountability Act, the Cable Commu- 
nications Policy Act, and the Video Privacy Protection Act, each expressly waived, 
in whole or in part. Federal preemption. Despite industry’s wishful repetition at a 
plethora of hearings this spring,® the FCRA never intended nor did it create an 
overall “uniform national standard.” Instead, the statute established a minimum set 
of Federal standards that have always been supplemented by varying State laws. 

By 1996, when Congress adopted a number of significant amendments to the 
FCRA, the credit reporting industry had grown dramatically and, indeed, operated 
nationwide in a seamless fashion notwithstanding diversity at the State level. In 
testimony earlier this month before the House Subcommittee on Financial Institu- 
tions and Consumer Credit, Vermont Assistant Attorney General Julie Brill thor- 
oughly documented the significant variations among State laws.® 

Nevertheless, among the 1996 FCRA Amendments, Congress included a tem- 
porary and partial preemption clause that prevents States for another 6 months 
from implementing certain types of stronger credit reporting provisions. Notwith- 
standing the temporary and narrow preemption, the 1996 Amendments explicitly 
exempted the stronger California, Massachusetts, and Vermont statutes from spe- 
cific elements of the narrow preemption.'^ Hence, even the 1996 Amendments did 
not create an overall “uniform national standard.” 

State Differences Do Not Appear To Impede Credit Reporting or Financial 
Decisionmaking 

The fairness rules and opt in approach contained in the FCRA enabled the credit 
reporting industry to progress from its fragmented, chaotic, and abusive period in 
the late 1960’s to a successful, respected component of the U.S. information-based 
economy. The FCRA obligations coupled with the ability of States to enact stronger 
protections, in effect, created today’s thriving national infrastructure of credit 
reporting. 

Industry-funded projects, however, assert the imminence of a “parade of horribles” 
should Congress not support industry’s desire to preclude stronger State privacy 
laws. Key “findings” from these projects are based on ideological hyperbole rather 
than comprehensive and accurate analysis. For example, some have argued that 
strong credit reporting rules overseas substantially hinder the “miracle of instant 
credit” and result in much higher interest rates or more onerous borrowing condi- 
tions.® These arguments have no apparent basis in fact or analysis. No other major 


'‘S.Rep. 91-517, 91st Cong., 1st Sess. 3, 8 (1969). 

®See e.g. Hearing on “The Growing Problem of Identity Theft and Its Relationship to the Fair 
Credit Reporting Act” before the Senate Banking Committee, 108th Cong., 1st Sess. (June 19, 
2003); Hearing on “Fair Credit Reporting Act: How It Functions for Consumers and the Econ- 
omy” before the Subcommittee on Financial Institutions and Consumer Credit of the House 
Committee on Financial Services, 108th Cong., 1st Sess. (June 4, 2003); Hearing on “the Impor- 
tance of the National Credit Reporting System to Consumers in the U.S. Economy” before the 
Subcommittee on Financial Institutions and Consumer Credit of the House Committee on Fi- 
nancial Services, 108th Cong., 1st Sess. (May 8, 2003). 

® Hearing on “Fair Credit Reporting Act: How It Functions for Consumers and the Economy” 
before the Subcommittee on Financial Institutions and Consumer Credit of the House Com- 
mittee on Financial Services, 108th Cong., 1st Sess. (June 4, 2003) (Statement of Julie Brill, 
Assistant Attorney General for Vermont). 

■'IS U.S.C. 1681t(b)(l)(F). 

® Hearing on “the Importance of the National Credit Reporting System to Consumers in the 
U.S. Economy” before the Subcommittee on Financial Institutions and Consumer Credit of the 

Continued 



250 


country to my knowledge has a comparable statute governing only credit report in- 
formation. Comprehensive data privacy laws applicable to most processing of per- 
sonal information do exist outside the United States such as those in Canada, in 
the United Kingdom and throughout Europe under European Directive 95/46/EC. 
These laws typically apply to credit reporting and are generally more protective of 
consumers than the FCRA. However, foreign consumer credit markets are struc- 
tured by banking law, bankruptcy law, real estate law, and consumer protection 
laws that often deviate significantly from those in the U.S. legal system. The attri- 
bution of differences in credit markets to general data privacy laws without exam- 
ination of the direct regulatory constraints on credit relationships such as interest 
rate regulation, down payment restrictions, or legal protections for security interests 
is specious and a misrepresentation of foreign privacy law. 

Others have even argued that, “increased competition, driven in part by 
prescreening, has caused [credit card] interest rates today to be . . . lower overall” ® 
as compared to 1990. Yet, the “analysis” omitted any mention of the dramatic drop 
in the prime rate that many card issuers use to calculate their credit card interest 
rates. In fact, between 1990 and 2002, the prime rate declined from 10.01 percent 
to 4.67 percent.i° Most rational observers would give Chairman Greenspan and the 
Federal Reserve the acclaim for declines in credit card rates rather than 
prescreening. 

To my knowledge, there is no study or evidence that examines the actual, existing 
differences among State protections and that shows these stronger protections de- 
monstrably impede the credit reporting system. Indeed, to my knowledge, no indus- 
try group has examined the effects of the three stronger State statutes recognized 
by Congress under the 1996 Amendments on either the credit markets in those 
States or on the nationwide industry. This is not surprising. A rudimentary look at 
Federal statistics suggests that credit decisions in these States benefit both lenders 
and consumers. Consumer bankruptcy filings per household, a basic sign of bad 
credit decisions, are markedly better for the three States with statutes recognized 
by Congress as more protective of consumer information. Vermont ranks 50tH with 
the lowest rate of consumer bankruptcies in the Nation, Massachusetts is 49th and 
California comes in below the median at 27th.ii 

Similarly, Federal statistics on interest rates seem to indicate that States with 
stronger credit reporting laws have lower rates. The most current annual Federal 
mortgage loan data indicates that the effective rate on a conventional mortgage for 
2002 was 6.25 percent in California, 6.43 percent in Massachusetts and 6.59 percent 
in Vermont.12 All were below the national median and California had the lowest 
rate in the Nation. Vermont Assistant Attorney General Julie Brill has also noted 
in testimony presented to the House Subcommittee on Financial Institutions and 
Consumer Credit that Vermont has the second lowest auto loan rates in the country 
and the other more privacy protective States rank well with low rates. 

While these statistics leave out important elements for a thorough assessment of 
the impact of stronger State laws such as a correlation with State unemployment 
data for bankruptcy filings and noninterest transaction costs for home mortgage 
loans, the data does show that the horror stories circulating about the preemption 
provisions make good theater, but reflect poor research. 

In fact, other countries with comprehensive data protection statutes such as Can- 
ada, demonstrate that robust credit information services can co-exist with strong, 
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comprehensive data privacy laws. For example, one major U.S. credit reporting 
agency operating in Canada offers a typical credit report for Canadians that con- 
tains information strikingly similar to the typical report for Americans. In the 
United Kingdom where a comprehensive data privacy law also applies, major credit 
card companies offer instant approvals for platinum cards just as they do in the 
United States. 

Weakening of Privacy Protections Raises Uncertainty and Decreases Confidence 

The bottom line is that strong privacy protections are essential for public con- 
fidence in the integrity of financial services in the United States. Without adherence 
to strict fair information practices, financial markets will face uncertainty because 
the risk of newsworthy privacy scandals increases such as those commited by 
Citibank,!® U.S. Bancorp,!® Fleet Bank,!! or Chase Manhattan.!® The weakening of 
fair information practice standards at the Federal level or the preclusion of stronger 
State protections puts companies at greater risk for privacy scandal and diminishes 
public trust in the fairness of industry treatment of personal information. 

The Affiliate Sharing Loophole Eviscerates FCRA Protections 

The FCRA created fundamental fairness in the treatment of personal information 
through adherence to the basic principle that information collected for one purpose 
should not be used for different purposes without the individual’s written consent. 
Surveys show that 96 percent of i^ericans object to secondary use of personal 
information.!® For information used to make financial decisions about consumers, 
citizens believe that fairness requires opt in permission. In 2001, citizens in North 
Dakota had the first and only opportunity in the Nation to take a real position at 
the polls on the dissemination of their personal financial information. The North 
Dakota State legislature had just watered down financial privacy from an opt in 
rule on third-party data sharing to an opt out rule. The citizens of North Dakota 
revolted. By an overwhelming 72 percent majority, the voters of North Dakota ap- 
proved a referendum restoring the old opt in rule and rebuking the legislature’s 
weakening of privacy standards. 

Previous to these expressions of public opinion. Congress introduced in 1996 a sig- 
nificant deviation from the FCRA’s historical commitment to this fundamental per- 
missible purpose principle. Congress amended the definition of a “consumer report” 
in Section 603(d) to exclude information shared among companies affiliated by com- 
mon ownership or control. This deviation allows organizations to escape the fair in- 
formation practice obligations of the FCRA for information that would otherwise be 
covered when such data is disseminated to affiliates. Those affiliated companies will 
not be subject to important FCRA requirements including those of use only for a 
permissible purpose, access, accuracy, and civil liability. 

Congress permitted this departure from the core principle only if the company 
provided consumers with notice of affiliate sharing and an opportunity to opt out. 
The far-reaching consequences of this deviation as a result of the successful liberal- 
ization of the financial services sector have not, however, been recognized or subject 
to public scrutiny. Large groups of affiliated financial and nonfinancial organiza- 
tions can now easily engage in exactly the same behavior that Americans find trou- 
bling — the dissemination of confidential credit report information for a wide range 
of activities unrelated to the purpose of collection — and escape the obligations of 
consumer reporting agencies and the opt in rule. 

The Blanket Exemption for Experienee and Transaction Data Opens a Pandora’s Box 

The 1996 Amendments first create a blanket exemption from FCRA protection for 
experience and transaction data. Section 603(d)(2)(A)(ii) excludes from the definition 
of “consumer report” any communication of experience or transaction data among 


!®See National Assoc, of Attorneys General, Press Release: Multistate Actions: 27 States and 
Puerto Rico Settle With Citibank (Mar. 1, 2002) available at http: I lwivw.naag.org I issues! 
20020301 -multi-citibank.php. 

!®See Minn. Attorney General Press Release, Minnesota Attorney General and U.S. Bancorp 
Settle Customer Privacy Suit (July 1, 1999) available at http:! ! www.ag.state.mn.usl consumer! 
privacy !pr! pr ushank 0701 1 999. html. 

!!See N.Y. Attorney General Press Release, Fleet Bank Agrees to New Privacy Protections 
(Jan. 16, 2001) available at http:! ! www.oag.state.ny.us ! press ! 2001 !jan!janl6b 01. html. 

!®See N.Y. State Dept, of Law, Annual Report 2000, at 24 (2000) available at http:! ! 
www.oag.state.ny. us ! 2000AnnualReport.pdf. 

!® Harris Interactive/Privacy & American Business Poll, Privacy On and Off the Internet: What 
Consumers want (Feb. 7, 2002) available at http:! ! www.aicpa.org! download !webtrust! 
priv rpt 21mar02.pdf. (53 percent of those polled reported a “major concern” while only 5 per- 

cent were “not concerned” if “the company will use my information outside of the specific trans- 
action for which it was intended (for example, to offer me other products and services)”). 
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“persons related by common ownership or affiliated by corporate control.” This 
means that organizations may disseminate experience and transaction data such as 
credit card performance information, insurance status, or brokerage account activity 
among related companies without key protections under the FCRA such as accuracy. 
If, however, the organization qualifies as a financial institution under the Gramm- 
Leach-Bliley Act, then the GLBA will require the organization to provide notice of 
its sharing practices to the consumer. But, under the GLBA, consumers will not 
have any right to dispute erroneous information, access the information, or even opt 
out of the sharing. 

The breadth of this exemption is likely to be very large with organizations such 
as Citibank that have an extraordinary array of related companies. At the same 
time, the scope of this exemption is also poorly understood. Industry practices are 
not transparent and consumers do not have access to specific information on the 
types of transaction and experience data that is shared nor do they have access to 
the identities of the actual recipients of such data and nor do they have information 
about the specific purposes for which the data is actually used by an identified affil- 
iate. If this exemption is retained, I believe that Congress needs to investigate the 
reach of this exemption. 

Affiliate Sharing Allows the Cireumvention of Basie Proteetions 

The most sweeping damage to the FCRA’s fairness principles comes from the next 
part of the affiliate sharing exemption. Section 603(d)(2)(A)(iii) excludes “commu- 
nications . . . [to] persons related by common ownership or by corporate control” 
from the definition of “consumer report.” To qualify for the exemption, the company 
must provide a one-time “clear and conspicuous” notice and must provide a single 
opportunity to opt out. Experience with the GLBA teaches that this limitation, how- 
ever, is not likely to be particularly informative or useful for consumers. 

Some companies justify this affiliate sharing provision by arguing that corporate 
families should be treated as one unit for consumer privacy purposes because cor- 
porate organizational structure does not have an effect on consumers.^® This claim 
is simply not credible. The existence of separate entities to avoid consolidated legal 
liability confuses operational responsibility for privacy, impacts consumers seeking 
to assure the fair treatment of their personal information, and undermines con- 
sumers seeking legal redress for violations. A confusing maize of companies helped 
Enron obscure its true behavior. The same holds true for affiliates sharing personal 
information. 

The exemption for affiliate sharing means that credit report information loses pro- 
tection when shared with far-flung related companies. Affiliated recipients can use 
and disseminate credit report information and ignore the fairness principles of use 
only for permissible purposes, consumer access (when no adverse credit, employ- 
ment, or insurance decision is made), storage limitations for obsolete data or obliga- 
tions for the correction of erroneous information. A consumer reporting agency 
might, for example, sell credit score information to one company as a permissible 
disclosure under the FCRA. If that purchaser were to transfer the score to an insur- 
ance affiliate, the transferred score would be excluded from the definition of “con- 
sumer report” and most of the consumer protection provisions would not apply. 

In effect, the exemption undermines the entire philosophy of the FCRA. Industry 
statements indicate that this mechanism is already being used to subvert the origi- 
nal protections of the FCRA: Decisions are made once again from data outside the 
general reach of consumers and without any consumer recourse. For example, 
TransUnion promotes the use of affiliate sharing for underwriting decisions.^^ 
Citibank reported to Congress earlier this month that it, “shares information among 
our affiliates . . . [including] credit application and credit bureau data, as well as 
information on our transactions with the customer.” MBNA indicates that it 


Hearing on “The Role of FCRA in the Credit Granting Process” before the House Committee 
on Financial Services Subcommittee on Financial Institutions and Consumer Credit, 108th 
Cong., 1st Sess. (June 12, 2003) (Statement of Martin Wong, General Counsel, Citigroup Global 
Consumer Group) (testifying that, “Corporate structure is usually driven by concerns that do 
not affect the customer, such as the company’s history of acquisitions or by corporate tax, legal, 
and accounting concerns.”) 

Hearing on “The Role of FCRA in the Credit Granting Process” before the House Committee 
on Financial Services Subcommittee on Financial Institutions and Consumer Credit, 108th 
Cong., 1st Sess. (June 12, 2003) (Statement of Harry Gambil, CEO, TransUnion), at p. 8. 

22 Hearing on “The Role of FCRA in the Credit Granting Process” before the House Committee 
on Financial Services Subcommittee on Financial Institutions and Consumer Credit, 108th 
Cong., 1st Sess. (June 12, 2003) (Statement of Martin Wong, General Counsel, Citigroup Global 
Consumer Group), at p. 4. 
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shares credit eligibility information including credit reports among affiliates.^® 
These are precisely the uses of personal information that the original FCRA sought 
to cover. 

The enormous scope of this exemption can be illustrated by a few examples of pos- 
sible practices among related companies. U.S. Bancorp included in its cardholder 
agreement a disclosure that said, “We share customer information within our orga- 
nization ... to better meet your needs” and provided instructions to opt out of affil- 
iate sharing. At the same time the company was settling a claim brought by the 
Minnesota Attorney General for disclosures of customer information to third parties, 
the company purchased Gargoyles — a company that designs and markets sun- 
glasses.®^ Would any consumer reasonably understand that Gargoyles might receive 
copies of the customer’s credit application or transaction history? While information 
is not available to determine if U.S. Bancorp actually transferred client data to Gar- 
goyles, the affiliate sharing provisions would disturbingly allow the transfer of cred- 
it report data to Gargoyles for sunglass marketing purposes. Gargoyles would then 
be free to redisseminate the information outside the confines of the FCRA. 

The potential circumventions are similarly disturbing when the affiliations of con- 
sumer reporting agencies are considered. TransUnion, for example, belongs to the 
Marmon Group.®® The group affiliates companies in a wide range of businesses 
including one in the syringe needle business and another in residential water treat- 
ment.®® If TransUnion provided notice of affiliate sharing and an opt out, the 
company could transfer credit reports to these affiliates. Experian is in the same 
situation. Great Universal Stores, a British company owns Experian, as well as 
Metromail and Burberry.®'^ If Experian were to provide notice of affiliate sharing 
and an opt out, Experian could share the credit reporting database with Metromail, 
a marketing company that paid $15 million to settle a lawsuit because the company 
was caught disclosing sensitive personal information to jailed convicts for proc- 
essing.®® Burberry could also supply credit report information to Metromail outside 
the protections of the FCRA. 

As it turns out, both Experian provides notice of affiliate sharing and opt out 
choices to a growing number of consumers. The company offers consumers online 
access to their credit reports and monitoring services. Experian appears to use reg- 
istration for these services as a means in the legal boilerplate to provide notice and 
opt out for affiliate sharing.®® In other words, consumers particularly concerned 
about the sanctity of their credit reports are likely to enable inadvertently the shar- 
ing of their data by the credit reporting agency with affiliates outside the protec- 
tions of the ECRA. No information, however, is readily available to determine 
whether Experian actually shares data with these affiliates or others. 

If these uses are or become widespread, then the FCRA loses both effectiveness 
and credibility. Since affiliate sharing generally escapes the transparency and accu- 
racy obligations of the FCRA, there is no way for a consumer to learn the magnitude 
of this problem. Even for those organizations regulated by the GLBA, affiliate shar- 
ing notices under the GLBA would not provide sufficient detail for a consumer to 
realize that a company like Experian might share with Metromail or that U.S. 
Bancorp might share with Gargoyles. 

If this loophole is closed. Congress can and should investigate whether companies 
have begun to circumvent the FCRA in this fashion. 


MBNA Privacy Notice, http: I / www.mbna.comlprivacy.html (visited June 23, 2003). 
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Affiliate Sharing Allows the Government To Engage in Surveillance Outside 
the FCRA Due Process Proteetions 

Sections 604 and 625 of the FCRA provide due process safeguards against Govern- 
ment surveillance of credit report information. Briefly, Government and law enforce- 
ment agencies may obtain credit report information for specified purposes with 
procedural safeguards or pursuant to a court order or a Federal Grand Jury sub- 
poena or, in the case of counterintelligence investigations, a statutorily defined FBI 
certification.^® However, affiliate sharing means these due process protections for 
access by law enforcement can easily be circumvented. If consumer report informa- 
tion is shared with an affiliate, the data loses its “consumer report” status and the 
FCRA protections would not apply to subsequent disclosures by the affiliate. This 
loophole would be one way for the “Total Information Awareness” program, an effort 
already the subject of Congressional concern,®^ to obtain detailed sensitive personal 
data on U.S. citizens and escape the need for compliance with privacy obligations. 

A simple example of the possible sharing between two affiliated companies illus- 
trates the magnitude of this potential problem. Equifax, the credit reporting agency, 
operates through a number of changing groups including the currently named U.S. 
Consumer Services Group.^^ This apparent group of affiliates provides information 
services to Government clients. Equifax includes a statement in its Online Privacy 
Policy & Fair Information Principles informing consumers who request copies of 
their credit reports that, “we may disclose any of the information, as described 
above [including Equifax credit file information], to affiliates which are companies 
that are related to us by common ownership or affiliated with us by common con- 
trol” and describing for consumers several opt out choices.^® Although the specific 
language of the current opt out choices might be insufficient to qualify for the affil- 
iate sharing exemption, a simple clarification would clearly enable Equifax to trans- 
fer the credit report information to members of the U.S. Consumer Services Group 
who, in turn, could sell the data to Government agencies without an otherwise per- 
missible purpose or court order. 

At present, I have no information to suggest that Equifax engages in this practice 
or that Government agencies or law enforcement officials are currently exploiting 
this loophole. I do, however, believe that this possible practice needs to be inves- 
tigated if Congress does not eliminate this loophole. 

States May Not Protest their Citizens Prior to January 1, 2004 

According to Section 624 of the FCRA, stronger State laws applicable to experi- 
ence and transaction data and to affiliate sharing are temporarily preempted, with 
the exception of Vermont’s affiliate sharing rule. If Congress allows these preemp- 
tions to sunset, the States will be reauthorized to protect their citizens against the 
circumvention of FCRA protections. The States can play a useful role experimenting 
and fine tuning workable solutions to the affiliate sharing loopholes. 

Security Risks and Threats to the Soundness of the Credit Reporting 
System 

The leakage of credit report information to affiliates for secondary purposes out- 
side the protections of the FCRA increases security risks and threatens the integrity 
of the credit reporting system. 

Affiliate Sharing Enhances Identity Theft Risk 

The circulation of credit report information to affiliates outside the core permis- 
sible purposes and outside the overall protection of the FCRA increases the risk of 
identity theft. Reports indicate that identity theft often occurs as an “inside job.” 
In testimony to this Committee last week, U.S. Secret Service Special Agent Tim- 
othy Caddigan stated: “The method that may be most difficult to prevent is theft 
by a collusive employee. The Secret Service has discovered that individuals or 
groups who wish to obtain personal or financial identifiers for a large-scale fraud 
ring will often pay or extort an employee who has access to this information through 
their employment at workplaces such as a financial institution, medical office, or 


30 15 U.S.C. §§ 1681b(a)(3)(D), 1681b(a)(4), 1681f, 1681u. 

3^ See e.g. Department of Defense, DARPA Report to Congress Regarding the Terrorist Infor- 
mation Awareness Program (May 20, 2003) http: ! I www.darpa.mil j body I tia I TIA%20ES.pdf 
33 See Equifax, Annual Shareholders Report Form 10-K for the Fiscal Year Ended Dec. 31, 
2002 (filed with the SEC on Mar. 23, 2003). 

33 Equifax Online Privacy Policy & Fair Information Principles (U.S. only) available at https:! 
I www.econsunier.equifax.com I consumer /forward.ehtml?forward=privacypolicy (visited June 24, 
2003) 



255 


Government agency.” Wide ranging affiliate sharing increases the exposure of 
credit report information to the risk that a malevolent insider will steal data for 
identity theft. 

Not surprisingly, some lobbyists deny that the wider circulation of personal infor- 
mation through secondary use of credit report data facilitates identity theft.®® Yet, 
in the context of prescreening, the overwhelming consensus among those involved 
in identity theft prevention is that preapproved credit card offers are one of the 
most common resources for identity thieves. The U.S. Postal Inspection Service, the 
U.S. Department of Justice, the U.S. Secret Service, and each of the major credit 
reporting agencies warn consumers that discarded, preapproved credit card offers 
are one of the most common sources of personal information for identity thieves.®® 
A lobbying paper sponsored by an industry group, the Privacy Leadership Initiative, 
admits that the average response rate to credit card offers in 2000 was only 0.6 per- 
cent.®'^ In other words, American consumers are not interested in 99.4 percent of 
these purportedly targeted offers and throw them away. There is no credible, public 
evidence to suggest that product or service offers generated through affiliate sharing 
will be of any greater interest to consumers. Yet, this type of secondary use of credit 
information creates an important leakage of data from confidential and secure credit 
reporting. 

The exemption for affiliate sharing also appears unnecessary for the purpose of 
fraud detection and prevention. Fraud detection and prevention would in most cases 
qualify as a “legitimate business need” under Section 604(a); the disclosure of credit 
report information for that purpose should be a permissible purpose. If legitimate 
reasons justify affiliate sharing outside the protections of the FCEA to detect or pre- 
vent fraud, a more narrowly drawn exemption for that specific purpose would 
reduce the risk of identity theft from wide circulation. 

Affiliate Sharing Introduces Homeland Seeurity Risks 

The global reach of U.S. corporate groups means that affiliate sharing may send 
credit report information on U.S. consumers to countries with high risk of political 
instability or terrorist action. As a consequence, U.S. consumer data may be subject 
to compromising risks. For example, banks may share credit report information with 
affiliates in India or the Philippines where no privacy rights apply and where local 
concerns for the safety of U.S. data are substantial.®® Indeed, unconfirmed reports 
suggest that many United States financial institutions transfer client data to India, 
but take careful steps not to reveal the existence of these off-shore arrangements. 

One specific example illustrates this potential risk. Fair Isaacs offers a 
“decisioning process” that handles “30 percent of U.S. credit card applicants, as well 
as auto loans, mortgages, loans, and lines of credit around the world” and offers a 
fraud detection system that monitors “more than 400 million payment card accounts 


Hearing on “The Growing Problem of Identity Theft and Its Relationship to the Fair Credit 
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worldwide.”^® Fair Isaacs appears to have an affiliated distributor in Malaysia,"*® a 
country for which the U.S. Department of State has issued a warning about the pos- 
sibility of terrorist attacks against American citizens and American interests.** 
While the exact ownership relationship between Fair Isaacs and the Malaysian part- 
ner is unclear, the point remains that if these companies are under common control, 
then the United States data may be sent there. In this particular case, there is also 
no readily available information that would suggest whether Fair Isaacs does indeed 
transfer United States credit report information to Malaysia. 

Without specific information on where affiliates are located and what information 
they receive, the magnitude of this risk cannot be evaluated. If Congress does not 
eliminate the affiliate sharing loopholes, I believe that this risk needs further inves- 
tigation. 

Recommendations for Future Action 

When Senator Proxmire introduced the original FCRA, he sought to preclude “the 
furnishing of information to Government agencies or to market research firms or to 
other business firms who are simply on fishing expeditions.”*^ The implications of 
the affiliate sharing loopholes seem to return consumers to the unfair and unsafe 
data handling practices of the pre-FCRA era. 

In sum, I believe that Congress needs to restore the FCRA to the higher level of 
its original protections for consumer privacy. 

To do so, I recommend the following: 

1. Eliminate the exemption for affiliate sharing from the definition of “consumer 
report” in the FCRA or allow the partial preemption clause in Section 624 to sunset 
on January 1, 2004. 

2. Investigate the actual sharing practices of credit report information among af- 
filiated companies and the uses of such data by the affiliated recipients that escape 
the protections of the FCRA. To this end. Congress should instruct each of the func- 
tional bank regulatory agencies and the Federal Trade Commission to investigate, 
audit and report to Congress on the actual sharing of consumer report information 
among affiliated companies and on the actual, unprotected uses of such data by the 
affiliated recipients. 


PREPARED STATEMENT OF RONALD A. PRILL 

Former President, Target Financial Services, Target Corporation 
ON Behalf of the National Retail Federation 

June 26, 2003 

Introduction and Background 

Good morning Mr. Chairman and Members of the Committee. My name is Ronald 
Prill. Until 3 weeks ago, I served as President of Target Financial Services, and also 
as Chairman and CEO of Retailers National Bank, Target Corporation’s credit card 
bank subsidiary. I am presently employed by Target as a consultant to our corporate 
management as I transition into retirement. I appreciate having been given this op- 
portunity to speak to you today on behalf of both my company and the National Re- 
tail Federation. 

Target Corporation, with annual sales of $44 billion, is the Nation’s fourth largest 
retailer. Like many other retailers, it has evolved to include many affiliated entities. 
Our divisions include 1,100 Target Stores (located in each of the lower 48 States 
except for Vermont), Mervyn’s (our chain of about 250 stores that sells moderately 
priced family fashion and home merchandise in primarily western States), Marshall 
Field’s (our oldest affiliate, with 62 full line department stores in 8 midwestern 
States) and Target, direct (our direct marketing affiliate which operates all of our e- 
commerce sites and direct marketing catalogs). Further, Retailers National Bank 
was established in 1994 as our limited purpose credit card bank affiliate. The bank 


See Fair Isaac, New Product Releases: Capstone Decision Manager, Falcon Fraud Manager 
for Issuers available at httpij I www.predictive.com.au I whatsnew.html (visited June 11, 2003). 

*®See http: ! / www.predictive.com.au/contacts.html (visited June 11, 2003). 

**U.S. Department of State, Public Announcement: Malaysia (May 14, 2003) available at 
http :/ / travel.state.gov / malaysia announce.html. 

*^Cong. Rec. Senate, Jan. 31, 1969 (statement of Senator Proxmire) reprinted in Hearings on 
Fair Credit Reporting S. 823 before the Senate Subcommittee on Financial Institutions of the 
Committee on Banking and Currency, 91st Cong., 1st Sess., at 436 (May 19-23, 1969). 
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presently has about 46 million credit cards in circulation, each of which carries the 
Target, Mervyn’s, or Marshall Field’s brand. 

Target Corporation, as well as many other retailers, use multiple affiliated enti- 
ties to execute critical business processes like sourcing merchandise, transacting the 
retail sales of goods and services, administering credit card programs, and deliv- 
ering other expected services and conveniences to their customers. Retail shoppers 
bring these expectations to every retailer they choose to patronize. Good retailers 
are attentive to the shopping habits, brands, styles, sizes, and price points their cus- 
tomers prefer. For consumers, the benefits they receive as a result of the sharing 
of information among a retailer’s affiliates are essential to their having a positive 
shopping experience. Further, the critical business processes that require the shar- 
ing of information among affiliates are essential to the success of the retail business. 

Mr. Chairman, retail affiliates use the sharing of information in ways that are 
unique to our industry in order to fulfill important business needs and to deliver 
real benefits to our customers. The list of the ways in which retailers share informa- 
tion among affiliates is a lengthy one, and I would like to briefly describe some of 
them for you today. 

Retail Credit Card Programs 

The sharing of information among affiliates is critical to offering credit through 
an in-store credit card program. Many retailers, including Target Corporation, have 
a chartered credit card bank, or other financial institution, that issues their com- 
pany’s credit cards. This entity is often set up as an affiliate of one or more retail 
divisions. Frequently, the servicing of these credit card accounts is provided by yet 
another affiliate of the bank. At Target Corporation for example, customer service 
for Target, Mervyn’s, and Marshall Field’s cards is provided by an affiliate of Retail- 
ers National Bank at two call center locations. The customer service representatives 
who answer these calls need access to detailed account information in order to an- 
swer cardholder questions. In fact, the customer service representatives first use in- 
formation to verify that the caller is, in fact, the true cardholder, and not someone 
attempting to perpetrate a fraud. Neither this customer protection nor subsequent 
servicing of the account would be possible without information sharing. 

Merchandise Returns 

Another example of affiliate information sharing that results in customer benefits 
is receiptless returns. Many retailers, including Target Corporation stores, generally 
require that customers who are returning merchandise present a sales receipt that 
reflects the purchase. Frequently, however, retail customers throw away, misplace, 
or forget their receipts. To remedy this problem, we, as well as other retailers, have 
developed receipt look-up systems, so that customers can return merchandise with- 
out presenting their original receipt. Specifically, a Target cardholder can simply 
present their Target credit card and a Target store team member will use our com- 
puterized returns system to look up and verify the original purchase then accept the 
return and issue a credit. 

The benefits of this system are clear: The cardholder does not have to return 
home, hunt for their original receipt, and then make another trip back to the store 
to make their return. They also do not have to keep merchandise they do not want 
in the event they cannot find the original receipt. As you might expect, our cus- 
tomers absolutely love this convenience. This service is made possible only because 
Retailers National Bank shares Target credit card purchase history information 
with its affiliated Target Stores. 

This return system also uses the same information to protect us from losses due 
to fraudulent returns. Because each item purchased and returned is so noted in this 
system, an item that was purchased once will be accepted as a return only once. 
Shoplifters who repeatedly steal the same item from our stores and attempt re- 
peated returns for repeated credit, sometimes even using counterfeit receipts, are 
stopped by the use of shared information. 

Warranties, Repairs, and Servicing 

Many retailers also have affiliated or third-party warranty or servicing depart- 
ments. The sharing of information about their customers among these affiliates 
makes each part of their business operationally efficient and also provides real bene- 
fits to customers. 

For example, in one case that I am aware of, a customer needed a specific part 
to repair his Craftsman lawn mower. After making the drive to the retail store he 
learned that the service department needed to know the specific model number of 
the lawn mower in order to find the exact part he needed. Unfortunately, this cus- 
tomer did not know the model number. Fortunately, however, since the mower had 
been purchased on his store credit card, an original purchase look-up could be done 
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instantly and the correct model number, and the correct repair part number were 
quickly determined. Because the retail credit card affiliate shares information with 
the service department, this business process can not only exist, but can be used 
to deliver great customer service. This very satisfied customer had to make only one 
round trip, rather than two. 

E-Commerce Affiliates 

As you know, many brick-and-mortar retailers that have e-commerce websites es- 
tablished their “dot.com” business organizations as separate entities. However, the 
sharing of information allows customers who make purchases at a retailer’s website 
to return or exchange those purchases by just bringing them into a brick and mortar 
store. These returns are more convenient, and save the customer the cost of a re- 
turn-shipping fee. Our e-commerce retail channels continue to grow at an amazing 
rate and the need to share information with the store affiliate in the brick-and-mor- 
tar channel is growing just as rapidly. 

Bank Check Authorization 

Many retailers have also developed in-house bank check authorization systems. 
These systems contain the MICE number sequence from customer checks that have 
been returned to the retailer unpaid by the customer’s bank, and which are still out- 
standing. This file of MICE numbers from returned checks is usually called the 
“negative” file. Some retailer’s negative files even include a list of MICE numbers 
from currently outstanding checks that have been returned unpaid to other busi- 
nesses. This supplemental information can be purchased from third party services. 
If a consumer whose check MICE number is in the negative file should attempt to 
write a new check to the retailer to pay for a new purchase, these check authoriza- 
tion systems will reject that check and protect the retailer from greater loss. Ulti- 
mately, the prevention of losses helps keep prices down for all of our customers. 

Many check authorization systems also include a “positive” file. This file consists 
of the MICE number sequence from checks previously written to the retailer that 
are now known to have been good checks. The positive file typically includes a 
record for each MICE number of how many good checks have been written to the 
retailer, over what length of time, and for what amounts. If a consumer whose check 
MICE number is in the positive file with a lengthy history of writing good checks 
should present a new check, the authorization system can instantly approve that 
check, even if it might be written for a large amount. 

Target Corporation is among those retailers who have such check authorization 
systems. To prevent larger losses by accepting new checks written at one of our re- 
tail affiliates by check writers who already have outstanding bad checks at another 
affiliate, we have a larger, common negative file that includes negative MICE num- 
ber information from Target, Mervyn’s, and Marshall Field’s. This sharing of affil- 
iate information supports a critical business process — authorization of bank 
checks — and helps us control our bad check losses. This protection against loss is 
especially important in cities where we have multiple stores including two, or all 
three, of our retail affiliates. 

Target Corporation retail affiliates also share their positive check writing data. 
As a result, we have a much larger common positive check file as well. This sharing 
of affiliate information benefits many of our check-writing customers as they shop 
in our retail chains. Checks written at one store can be instantly approved because 
our common positive check file includes the positive history information from an af- 
filiated store. 

Further, our Eetailers National Bank affiliate mails over 9 million statements 
each month. Most payments on Target, Mervyn’s, and Marshall Field’s accounts are 
made by check and, of course, most of those checks are good. In fact, through their 
account with us, many of our store credit cardholders also have a long and excellent 
check writing history with our Eetailers National Bank affiliate. Our credit card 
bank shares these positive check-writing histories with its retail affiliates by pass- 
ing these MICE numbers to the common positive check file. As a result, millions 
more customers can write checks for substantial amounts in all of our affiliated 
stores and have their checks approved instantly. 

Preventing Identity Theft 

Information is also a retailer’s best weapon against identity theft. As you know, 
identity theft is one of the fastest growing crimes in the United States. At Target, 
we have implemented a number of safeguards to help protect our business and our 
customers — all of which require information sharing. 

Identity thieves thrive on anonymity and rely on the assumption that large retail- 
ers such as Target cannot put a name and face together in order to prevent fraud. 
This is why it is so important for retailers to know their customers, and the only 
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way we can do this is through the use of information. Information flows between 
Retailers National Bank and the credit bureaus or between our retail affiliates, com- 
bined with sophisticated technology, cuts down on fraud and allows us to offer ex- 
ceptional customer service. 

Customer Loyalty Programs 

Retailers today have to work hard to keep their best customers. In recognition of 
this, many retailers have developed customer loyalty programs to help them identify 
and reward their best customers. Loyalty program participants typically receive 
benefits such as discounts on their purchases, free gift-wrapping, free alterations, 
and other free or discounted offers. Many of these programs are offered only to store 
credit cardholders and are based on cumulative purchase levels. Often, some or all 
of the purchase history data for a retailer’s customer resides with an affiliate, and 
the sharing of information among affiliates becomes essential to coordinate and ad- 
minister a successful rewards program. 

Communicating With Our Customers 

In addition to protecting customers and providing customer services, affiliate in- 
formation is also used for marketing. Some retailers depend heavily on direct mail 
to reach their customers. Clearly, some of this is general advertising. The catalog 
for a large storewide sale, for example, is mailed to a large share of customers. How- 
ever, some advertising is targeted to specific customer groups. For instance, a re- 
tailer might send advertising about an upcoming semi-annual home sale event to 
its most recent home furnishings customers, or offer a free gift with purchase to its 
customers who buy a particular brand of cosmetics. Retail customers expect to re- 
ceive such advertising and information. In fact, many retail credit cardholders cite 
getting these mailings as among the key reasons they opened their account in the 
first place. Additionally, the most frequent and vocal complaints that retailers re- 
ceive from their customers usually involve catalogs and sale information that did 
not arrive at a customer’s home, or arrived late. 

Many retailers today depend on their credit card bank affiliate, or their direct 
marketing affiliate, as the repository of the names and addresses and the purchase 
histories of their customers. They further depend on affiliate sharing of this infor- 
mation to communicate effectively with their customers. These retailers would be 
unable to market their goods and services or even reach their customers without 
these information flows. Retail customers not only accept this sharing, they expect 
this sharing. They are very aware of the benefits they get because of the availability 
of information where it is needed, and when it is needed. The type of information 
we collect from each customer and its uses are also explained clearly to our cus- 
tomers in our Privacy Policy. 

Organizational Structure Should Not Matter 

In order for retailers to give our customers the service they expect, information 
sharing among our affiliates is absolutely necessary. This complex business struc- 
ture is in place for many technical, legal and accounting reasons, however the struc- 
ture is completely transparent to our guests. Through information sharing with 
these entities we can not only market more specifically to our customers and provide 
them exceptional customer service, but we can also do things such as prevent fraud 
and combat identity theft in our stores. 

Mr. Chairman, retail stores take on many different corporate structures. Some re- 
tailers issue their own credit cards in-house. Other retailers use a credit card bank, 
or other financial services affiliate, to issue store credit cards. Other retailers have 
contractual arrangements with unaffiliated, third party credit card service providers 
like GE Capital who own and operate the retailer’s customer credit card function. 

Further, some retailers have established their e-commerce business as a separate 
entity, while others have not. Some retailers have a separate catalog and/or direct 
mail affiliate. Others have made these functions part of the advertising or merchan- 
dising departments within each of their retail entities. Some retailers own all of 
their retail store departments and businesses. Other retailers have third party lease 
arrangements for some merchandise or service categories (such as cosmetics, fine 
jewelry, or a beauty salon), while others have selectively established separate affili- 
ated entities as part of their store. 

All retailers, regardless of organizational structure, need to reach their customers. 
They need to have access to and use the same kinds of customer information to run 
their business and compete in an efficient manner, regardless of how they are struc- 
tured. Retail customers expect to receive the same kinds of services, recognition, 
conveniences, amenities, and advertising from their favorite retailers, regardless of 
structural differences. They expect to be able to write a check as easily in one de- 
partment of a store as in any other. They also expect to be able to use their credit 
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card in every department in which they shop. Finally, customers expect to be pro- 
tected from identity theft and, as we are always hearing, they want to receive retail 
sale catalogs and other promotional materials. 

The amount of information about our customers that retailers share among our 
business, control and operating functions, or our various computer subsystems, is 
the same, whether this sharing at a particular retailer ever crosses an affiliate line 
or not. This information is treated with the same care and control and used to sat- 
isfy similar business requirements or deliver similar customer benefits regardless 
whether we may have chosen different business structures. Therefore, our ability to 
access information about our business relationships with our customers should not 
be dependent on what structure we have chosen. 

Finally, many people have asked what affiliate sharing has to do with the grant- 
ing of credit. The answer is: A lot. Retailers use the data and transaction histories 
that they collect from their stores and affiliates to create internal credit scores and 
models that predict the credit habits of their customers. This information supple- 
ments credit reports and FICO scores to paint the most accurate picture possible 
of a customer. In fact, retailers most often use this type of proprietary information 
to grant credit to people on the margins, in lower- to middle-income households who 
do not have prime FICO scores, or to those who are just entering the credit market. 
Mr. Chairman, retailers want to help our customers make purchases to meet their 
needs. And many times, this means emergency purchases such as a new hot-water 
heater or refrigerator — both big-ticket items that require credit approval. 

In closing, I would like to take this opportunity to emphasize the retail industry’s 
strong support for the permanent reauthorization of the seven areas of preemption 
contained in Section 624 of the Fair Credit Reporting Act. Without the extension 
of the uniform national standards, retailers and the customers we serve may be sub- 
ject to a confusing patchwork of new State laws, rules, and regulations governing 
fundamental and important areas such as dispute resolution and the information 
contained in credit reports. And, as today’s hearing reflects, services that millions 
of customers have come to rely on, and that they routinely take advantage of, could 
be disrupted if information flows are interrupted. 

Mr. Chairman, Members of the Committee, consumers have come to expect in- 
stant access to credit when purchasing everything from an automobile to consumer 
goods such as furniture, appliances, and apparel. In the final analysis, we in the 
retail industry have a real concern that a more fragmented process for information 
sharing and credit approval would negatively impact consumers in many different 
levels and, as a consequence, retail sales, ultimately costing jobs and hurting the 
economy as a whole. 

Thank you again for the opportunity to testify here today. I look forward to work- 
ing with all the Members of this Committee to permanently reauthorize the FCRA 
preemptions before they expire on December 31 of this year. 

I would be happy to answer any questions you may have. 


PREPARED STATEME N T OF TERRY BALOUN 

Regional President and Group Head, Wells Fargo Bank 

June 26, 2003 

My name is Terry Baloun and I am the Regional President and Group Head for 
Wells Fargo banks located in South Dakota, North Dakota, and Montana. Wells 
Fargo, our parent company, is a diversified financial services company, offering 
mortgage, securities, insurance, real estate services, online banking, institutional 
and retail banking products under the Wells Fargo brand through a number of sepa- 
rately incorporated affiliates to 15 million customers nationwide. Wells Fargo’s 
headquarters is in San Francisco; the company has 130,000 employees, has mort- 
gage offices nationwide, and has a retail banking presence in 23 States. 

'Thank you. Chairman Shelby and Committee Members for the invitation to testify 
and respond to your questions. I would like to share with you some of my experi- 
ences in providing banking services to communities within the framework estab- 
lished by the Fair Credit Reporting Act. 

Our Wells Fargo banks work in concert with other Wells Fargo business affiliates 
in providing financial services products to customers. Marketplace experience shows 
that consumers expect the financial services companies they do business with to 
know about their accounts, to respond quickly to their questions, and to advise them 
about products and services that will help them reach their financial goals. The 
service consumers expect requires that Wells Fargo have integrated information sys- 
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terns to give customers what they want — when, where and how they want it. Subject 
to the Fair Credit Reporting Act, Wells Fargo shares customer information inter- 
nally to meet these goals. 

Information Integration by Affiliates in the Same Corporate Family 

Providing a new mortgage, providing rural or remote small businesses with credit, 
offering consolidated statements for customers with multiple Wells Fargo products 
requires information about their financial affairs. Applying inappropriate restric- 
tions on transfers of information among affiliates would impede customer service. 

The 1996 Amendments to the Fair Credit Reporting Act recognize the value to 
customers of the ability to transfer information among affiliates. This ability is 
wholly consistent with consumer expectations that their questions will be answered 
and their needs will be met with a single call or a single e-mail message, whether 
their financial products are provided by a single company or seyeral companies in 
the same affiliated group. To put it another way, customers do not care whether for 
technical, regulatory, or management reasons Wells Fargo chooses to organize itself 
into a particular series of affiliates of a holding company or subsidiaries of one bank. 
What customers do care about is the seamless deliyery of the products Wells Fargo 
offers regardless of how we choose to distribute them. 

In Wells Fargo’s view, it is consumer expectations and needs that should shape 
the public policy that regulates information use, not legal structure. Because of legal 
requirements that prohibited or restricted bank branching. Wells Fargo at one time 
owned numerous separately incorporated banks. The Riegle-Neal Act of 1994 al- 
lowed bank holding companies to consolidate banks into as few as a single charter. 
Today, for business reasons rather than legal reasons. Wells Fargo owns 28 sepa- 
rately chartered banks. But the number of separate banks that a holding company 
chooses to haye should not affect public policy relating to information use. If a hank 
holding company conducts its banking business in a single bank entity that bank 
would haye all the information about a customer who had deposits, a mortgage, a 
credit card, and a home equity loan from that bank. As a single corporate entity, 
it could use this information without restriction to serve its customer. 

If, on the other hand, the bank holding company chooses to conduct its mortgage, 
credit card, and home equity loan businesses in three separately incorporated banks 
and the law restricted the sharing of information among affiliates, a customer who 
supplied the same information for the same products to three affiliated institutions 
instead of a single institution would not receive the same level of service from its 
financial services company. To use customer information to provide the same level 
of service that could be provided by a single entity with the same information about 
the same customer, a holding company like Wells Fargo that provides services 
through multiple bank and nonbank charters would have to consolidate its oper- 
ations into as few charters as legally possible. If the FCRA debate remains unre- 
solved, institutions like Wells Fargo will likely change their corporate structures to 
reduce the number of separate entities rather than risk restrictions on information 
sharing among affiliates. It is our view the corporate structure should not be a fac- 
tor in setting public policy regarding information use. The touchstone, instead, 
should be consumer expectation. 

This is especially critical to our mortgage business. Since passage of the 1996 
Amendments to the Fair Credit Reporting Act, mortgage servicing has become more 
efficient. Wells Fargo customers have more channels through which they can apply 
for a mortgage and get assistance or conduct transactions related to a mortgage, as 
well as the complete array of financial products offered by Wells Fargo. In Cali- 
fornia, 40-60 percent of Wells Fargo’s mortgages originated this year are the result 
of referrals from Wells Fargo Banks to Wells Fargo Home Mortgage. Many are first- 
time homebuyers in Hispanic market areas. With affiliate transfers and use of cus- 
tomer information, mortgage customers can make a mortgage payment at their local 
bank branch, obtain balances, get consolidated statements, and get the support of 
24-hour call centers that serve an entire affiliated enterprise. Our customers have 
found these services valuable. 

Sharing of customer information also benefits our small business customers. The 
basis for small business lending over the last 10 years has been direct mail offers 
of preapproved credit. Wells Fargo has extended nearly 500,000 small business 
loans since the mid-1990’s. The FCRA allows Wells Fargo to provide such credit, 
based on Wells Fargo’s own experiences with the customer and the most current 
credit report. Generally, small businesses no longer need to submit tax returns or 
financial statements, providing easier and cheaper credit for the business owner. 

Actions by multiple States to enact their own State versions of the Fair Credit 
Reporting Act will frustrate customers that do routine transactions across State 
lines. Wells Fargo provides services to thousands of customers that may have ac- 
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counts “domiciled” in one State, yet reside or do business with a Wells Fargo bank 
in another State. Nearly half a million Wells Fargo customers have made teller or 
ATM transactions out of State within the past 5 months. In my banking States of 
South and North Dakota and Montana, nearly 10 percent of Wells Fargo’s cus- 
tomers live in one State, but use Wells Fargo banks or ATM’s in a bordering State. 

Uniform National Standard 

Finally, Wells Fargo believes the current uniform national standard for informa- 
tion use, as provided by the 1996 Amendments to the FCRA, is vital and asks that 
this Congress provide clarity and stability by removing the sunset provisions that 
affect affiliate sharing and other segments of credit granting. Congress should also 
address identity theft and set new national standards for notices about information 
use to customers. The problem of identity theft and complicated notices about infor- 
mation use are frustrating to both customers and financial service providers. 

The availability of financial services, such as mortgages for our customers and the 
flows of information required to make those services available, do not stop at State 
borders or corporate structures. 

Thank you and I would be happy to answer any questions that you. Chairman 
Shelby, or the Committee may have. 
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Good morning, Chairman Shelby and distinguished members of the Senate 
Committee on Banking, Housing and Urban Affairs. Thank you for inviting me to speak 
with you today on the important issue of affiliate sharing and its relationship to the Fair 
Credit Reporting Act. My name is Julie Brill, and I'm an Assistant Attorney General for 
the State of Vermont. I have been working in the consumer protection area for 12 
years, and have specialized in privacy issues in Vermont. In addition, I am co-chair of 
the National Association of Attorneys General Working Group on Credit Reporting, and 
co-chair of the National Association of Attorneys General Working Group on Privacy. In 
these capacities, I have worked through the National Association of Attorneys Generai 
on numerous national issues relating to credit reporting, affiliate sharing, and privacy, 
including comments to Congress and various federal agencies. 

I would like at the outset to recognize the important role played by this 
Committee in protecting consumers' interests by allowing states to enact more 
protective laws with respect to privacy of financial information, including sharing of 
affiliate information. Indeed, in both the credit reporting and financial privacy arenas, 
Congress has created a dual regulatory structure: national baseline standards are 
supplemented by state laws that provide greater protections. 

In these comments, I recommend that Congress permit this dynamic, dual 
system for regulating information flows within corporate affiliate groups and to third 
parties, to flourish both by allowing the affiliate sharing and other preemption provisions 
contained in the Fair Credit Reporting Act to sunset as originally contemplated, and by 
not enacting any further temporary or permanent provisions that would preempt the 
states from creating innovative solutions to problems stemming from the flow of 
information that consumers would like to keep private. 
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I make the following specific comments and recommendations in this testimony: 

1 . Congress should provide consumers with greater abiiity to restrict 
information flow within a corporate affiliate group, and should ensure that 
consumers receive better notices about these improved rights. As a result 
of the Gramm-Leach-Bliley Act, corporate affiliates are enormous and 
amorphous. Unrestricted information flow among corporate affiliates, and 
nearly unrestricted information flows from these corporate groups to third 
parties, has the potential to facilitate fraud and identity theft. Current 
federal law is woefully inadequate in providing consumers with sufficient 
rights to restrict this information flow, and in providing appropriate notice 
about the few rights consumers do have under federal law. 

2. States should be allowed to continue to provide greater protections 
with respect to affiliate sharing. Vermont’s economy has not been harmed 
by its more protective affiliate sharing laws. Congress should continue to 
allow states to play their traditional role as “laboratories of democracy” and 
enact more protective laws governing privacy and credit. 

3. Congress should sunset the FCRA 's affiliate sharing preemption 
provision to eliminate potential confusion over the scope of the preemption 
provision. Congress never intended to bar states from enacting any laws 
relating to affiliate sharing. Rather, the affiliate sharing preemption 
provision contained in the FCRA is merely intended to preempt state laws 
that would regulate affiliate sharing under a credit reporting framework. 
Continued confusion over the scope of the affiliate sharing provision, 
created by the financial services industry’s arguments that the affiliate 
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sharing provision is broader than Congress intended, is another reason 
why Congress should allow the affiliate sharing preemption provision to 
sunset. 

I. BACKGROUND 

A. Federal Law on Affiliate Sharing 

There are two federal laws that specifically address information flow from and 
within a corporate affiliate group: the Gramm-Leach-Bliley Act (GLB),^ passed in 1999, 
and the Fair Credit Reporting Act (FCRA or federal FCRA), ^ originally passed in 1970® 
and substantially amended in 1996.'* 

GLB made several fundamental changes to the laws governing the financial 
system, including expanding the types of financial institutions that may be affiliated with 
one another.® 

GLB also established some baseline rules governing the circumstances under 
which financial institutions may disclose personal information about their customers to 
unaffiliated third parties. GLB generally requires that a financial institution provide a 
clear and conspicuous notice of its privacy practices, an explanation of how consumers 
can "opt out” before sharing their non-public information with unaffiliated third parties, 
and the opportunity to opt out, unless certain exceptions apply.® GLB does not 
specifically address the sharing of information among subsidiaries or other corporate 
affiliates within one corporate structure. With respect to sharing information among 
such affiliates, GLB contains a “savings clause,” indicating that “nothing in [GLB] shall 


' Pub. L No. 106-102. 

^ISU.S.C. §1681 etseq. 

®84Stat. 1136; Pub L. No. 91-508 (Oct. 26, 1970). 

* Pub. L. No. 105-107, 111 Stat. 2255 (Nov. 20, 1997) (hereinafter “1996 Amendments”). 
° See infra. Section MA. 

® See 15 U.S.C. §§ 6801-6809. 
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be constaied to modify, limit, or supersede the operation of the Fair Credit Reporting 
Act.”^ It is thus necessary to examine the federal FCRA to determine the extent to 
which federal law regulates the sharing of financial information among corporate 
affiliates. 

The federal FCRA sets standards for the collection, communication, and use of 
information that constitutes a “consumer report,” generally defined as a communication 
of information bearing on a consumer’s credit worthiness, credit standing, credit 
capacity, character, general reputation, personal characteristics, or mode of living.® In 
1996, Congress adopted amendments to the FCFtA that, among other things, 
specifically exclude from the definition of a consumer report “any report containing 
information solely as to transactions or experiences between the consumer and the 
person making the report.”® This “transaction and experience” information could 
include, for example, detailed information about a customer’s purchases made on a 
credit card issued by the financial institution, as well as the customer’s outstanding 
balance, the customer payment history, and the length of time a customer has held a 
credit card.^° Thus, “transaction and experience” information can be shared by a 
corporation with its affiliates and with unaffiliated third parties without any notice or 
choice to the consumer. 

The 1996 Amendments also exempt from the definition of a “consumer report” 
the communication of other information among affiliated companies - that is, 
information other than transaction and experience information that would ordinarily be 


' 15 U.S.C.§ 6806(c). 

'15U.S.C. §1681a(d)(1), 

“ 15 U.S.C. § 1681a(d)(2)(A)(i). 

OCC Advisory Letter 99-3 (March 29, 1999). 
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considered a consumer report - if certain conditions are met. Examples of categories of 
such other information include data: 

from a consumer’s credit application, including income information; 
from a consumer’s credit report, including credit scores and history; 
obtained by verifying representations made by a consumer; and 
provided by another entity regarding its employment, credit, or other 
relationship with a consumer.” 

In addition to income and credit information, “other” information can include 
employment history with others, marital status, and medical history.’^ 

The federal FCRA pennits a financial institution to freely share this other 
customer information among affiliated companies so long as the consumer is given 
notice and an opportunity to opt out of the information sharing.’^ 

8. State Law on Affiliate Sharing 

In enacting both GLB and the FCRA, Congress recognized the essential role 
played by the numerous and varied state laws in the Nation’s dual regulatory scheme 
for financial privacy and credit reporting. Section 507 of GLB allows states to adopt 
financial privacy laws relating to sharing information with unaffiliated third parties that 
are more protective than GLB's requirements.” And the 1996 FCRA Amendments 
specifically recognized the importance of the wide variety of state laws governing credit 


" See 65 Fed. Reg. at 63,129. 

“ See 65 Fed. Reg. at 63,129. 

” 15 U.S.C. § 1681a(d)(2)tA)(iii). Failure to comply with the conditions for afffiiate sharing under Uie 
federal FCRA can result in a determination that the financial institution is a consumer reporting agency 
under the federal FCRA. A consumer reporting agency Is subject to various legal obligations to maintain 
and safeguard consumer informatim, including limitations on the purposes for which infonnation can be 
sold or distributed, 15 U.S.C. § 1681b, and requirements to provide consumers an opportunity to review 
information mainteiined about them, as well as establish particular error resolution procedures and 
consumer complaint mechanisms. 15 U.S.C. §§ 1681g{aK1); 1681(i); see Federal Reserve Regulatory 
Service, Questions and Answers about the Fair Credit Reporting Act, The Financial Institution as a 
Consumer Reporting Agency, FRRS 6-1605. 
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reporting, and did not subject the majority of those laws to preemption.^® Rather, 
Congress determined that only seven limited areas required some form of preemption, 
including the sharing of information among affiliates.^^ Even then. Congress decided 
that certain state laws affecting the seven limited areas that were in existence at the 
time of the 1996 amendments should be exempt from preemption.'® In addition, 
Congress specifically did not preempt any settlements between the credit reporting 
agencies and any State Attorney General that were in existence prior to the effective 
date of the 1996 Amendments.'® Finally, Congress determined that all states would be 
able to enact more protective laws in the seven areas, including affiliate sharing, 
beginning on January 1, 2004.®° 

Vermont is the only state that had a law directly regulating affiliate sharing in 
1996, and therefore has the only state law on affiliate sharing that was exempted from 
preemption in the 1996 Amendments. Vermont’s state Fair Credit Reporting Act 
"consent provision" requires that no “person” may obtain a credit report about a 
consumer unless the report is obtained pursuant to a court order or consumer 


”15U.S.C.§6807. 

For a description of the breadth of state credit reporting iaws, see generally Hearing on Fair Credit 
Reporting Act: How It Functions for Consumers and the Economy, Before the Subcommittee on Financial 
Institutions and Consumer Credit, House Committee on Financial Services, IOB'" Cong., June 4, 2003, 


(Statement of Vermont Assistant Attorney General Julie Brill). 

'®15U.S.C. §1681t(a). 

'MSU.S.C. §1681t(b) and(c). 

15 U.S.C. §§1681t{b)(1)(B) (time periods for taking action required when a consumer disputes 


accuracy of a report); 1681t(b)(1)(E) (information contained in a credit report); 1681t{bX1)(F) 


(Massachusetts and California laws relating to responsibilities of furnishers of information to credit 


reporting agencies); 1681t(b)(2) (Vermont law relating to affiliate sharing of information) 

15 U.S.C. §1681t(d)(1). This includes the multi-state settlements with TRW, Equifax and Trans Union. 
“ 15 U.S.C. §1681t(d)(2). 

15 U.S.C. §1681t(b)(2). 
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consent.^^ This consumer consent requirement appiies with equai force to credit reports 
shared among affiliates. 

Vermont’s FCRA exempts “transactions or experiences” information from the 
state’s definition of “credit report. Consequently, Vermont law, like federal law, allows 
affiliates to share transaction and experience information without any notice to a 
consumer and without any way for a consumer to prevent the sharing. 

In contrast, before financial institutions can share "other" information about 
Vermont consumers with their affiliates under Vermont law, the institutions must obtain 
affirmative consent - or opt in - from the consumer. Failure to comply with Vermont's 
FCRA consent provision can subject financial institutions to civil penalties.^^ 

While no other state has yet enacted laws specifically addressing affiliate sharing 
among financial institutions, several local governmental bodies in California have 
adopted ordinances governing financial privacy that include provisions on affiliate 
sharing.^ The California ordinances are the subject of a current court challenge.^® 

II. PROBLEMS WITH THE FEDERAL SCHEME FOR REGULATING AFFILIATE 

SHARING. 

The current federal scheme for regulating sharing of nonpublic financial 
information among affiliates does not adequately protect consumers. Consumers do 


“ 9 V.S.A. § 2480e(a)(a) and (2). “Person” is defined in Vermont iaw as inciuding “any natural person, 
corporation, municipality, the state of Vermont or any department, agency or subdivision of the state, and 
any partnership, unincorporated association or other legal entity.” 1 V.S.A. § 128. 

“ 9 V.S.A. § 2480a(2)(A) 

9 V.S.A. §§ 2480f(c) and 2458 state that the Vermont Attorney General may, in the event of a violation 
of the Vermont FCRA, obtain an injunction; a civil penalty of not more than $1 0,000 per violation; an order 
for restitution; and reasonable costs and fees. 9 V.S.A. § 2480f(b) states that, in the case of a “willful” 
violation by a “person” of the Vermont FCRA, a consumer may obtain actual damages or $100, whichever 
is greater; injunctive relief; punitive damages in the case of a willful violation; and reasonable costs and 
attorneys fees, 

^ County of San Mateo Ordinance Number 04126 (enacted Aug. 6, 2002; amended Nov. 5, 2002); City of 
Daly City Ordinance 1295 (enacted Sept. 9, 2002; amended Nov. 12, 2002); County of Contra Costa 
Ordinance Number 2002-30 (enacted Sept. 24, 2002; amended Nov. 5, 2002 and Feb, 25, 2003). 

^ Bank of America, N.A. v. City ofDaiy City, CA. USDC No. C 02 4343 CW (N.D. CA. May 23, 2003). 
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not understand the broad array of institutions that are currently allowed to share 
information within a corporate group under federal law. Many financial institutions 
currently consist of thousands of corporate affiliates, involved in vastly disparate 
activities. Consumers have no knowledge of, and no choices with respect to, many 
types of information sharing among these vast corporate groups. Moreover, the torrent 
of information flowing among thousands of corporate affiliates has the potential to lead 
to consumer fraud and identity theft. Finally, to the extent that federal law requires 
notices to consumers about this information sharing, these notices are woefully 
inadequate. 

A. Consumers Need Notice and Choice With Respect to Corporate Affiliate 
Information Sharing Practices In Light Of The Huge and Amorphous 
Nature of Corporate Affiliate Groups 

The breadth and number of affiliates of some financial institutions is breathtaking, 
yet most consumers remain unaware of the existence or identity of their financial 
institutions’ affiliates, and of the information flow among the vast corporate network. 
Consumers should be better protected from the potential harms associated with affiliate 
sharing by giving them an effective choice before credit-related information can be 
shared throughout a vast corporate complex. 

Under the federal FCRA, consumers have no choice as to whether their 
transaction and experience information will be shared with their financial institution’s 
corporate affiliates. Moreover, neither GLB nor the FCRA require corporate affiliate 
groups to give consumers any notice with respect to sharing information with marketing 
partners pursuant to a joint marketing agreement.^^ And once consumers are given a 
notice and opportunity to opt out, all information can also be shared with the corporate 

27 


15 U.S.C.§ 6802(b)(2). 



272 


affiliate group. Thus information about the consumer’s income, employment history, 
credit score, marital status, and medical history can be shared with ease among 
corporate affiliates under current federal law. 

GLB greatly expanded the activities that were permissible under one corporate 
umbrella, as it allowed insurance, securities, and banking institutions to affiliate with 
each other. Even prior to enactment of GLB, financial institutions were allowed to 
affiliate with a broad spectrum of companies. The list of activities that are identified by 
the Federal Reserve Board in its rulemaking as “financial” in nature or closely related to 
financial activities, and therefore permissible for inclusion within a financial holding 
company, goes well beyond traditional financial activities.^® 

Thus the types of businesses with which traditional financial institutions may now 
affiliate themselves, in addition to banking, insurance and securities brokerage, include: 
mortgage lenders; "pay day" lenders; finance companies; mortgage brokers; account 
servicers; check cashiers; wire transferors; travel agencies operated in connection with 
financial services; collection agencies; credit counselors and other financial advisors; 
tax preparation firms; non-federally insured credit unions; investment advisors that are 
not required to register with the Securities and Exchange Commission; and certain 
retailers and automobile dealers.^® 

The number and breadth of affiliates currently associated with some of the 
country’s major financial institutions is astounding. The corporate affiliate lists for Bank 
of America Corporation, CitiGroup, Inc., and KeyCorp,®® submitted with these comments 
as Exhibits 1,2, and 3 respectively, serve as three examples of the level of affiliation at 

See 12 U.S.C. §4(k); 12 C.F.R. § 225.28; 12 C.F.R. § 211.5(d). 

16 C.F.R. §§ 313.1(b) and 313.1(k)(2). 
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large- and mid-sized banking institutions in this country. Bank of America currentiy lists 
1 ,333 corporate affiliates; CitiGroup iists 1,657 corporate affiiiates; and KeyCorp lists 
883. A perusal of these corporate affiliate lists demonstrates that these holding 
companies appear to be involved in the full breadth of disparate activities authorized 
under federal law. Some of these affiliate operations may, in the normal course of their 
business, gather highly personal health information about consumers. A consumer 
holding a credit card with the lead bank or a property and casualty Insurance policy with 
a major insurer in any of these affiliate groups would not expect that his or her 
transaction and experience information would be spread throughout the corporate 
affiliate structure for the purpose not of servicing the consumer better, but of marketing 
products to the consumer. 

For these reasons, thirty-four States, the District of Columbia, Puerto Rico, and 
the Northern Mariana Islands informed the U.S. Treasury Department that the only 
appropriate mechanism for giving consumers control over sharing of information within 
such broad affiliate groups is to require that consumers be given effective notice and 
choice before their information may be shared with affiliates.^^ 

B. Unrestricted Information Flow. Both Among Affiliates and to Third Parties. 

Has Harmed Consumers 

Corporate sharing of nonpublic financial information, both within affiliate groups 
and with third party telemarketers, has led to fraud. Greater consumer protections to 
guard against such practices should be incorporated into both federal law and state law. 


“These lists, as well as other corporate affiliate lists for bank holding companies can be obtained at 

http://132.200.33.161/nicSearch/servlet/NICServlet?$GRP$=INSTHIST&REQ=iVIERGEDIN&MODE=SEA 

RCH 

Comments Submitted to US Treasury on GLBA Information Sharing Study By 37 States and Territories, 
May 1, 2002, availabie at http://www.naag.org/issues/20020502-multi-finjnfo.php. 
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The NationsBank case represents an example of inappropriate affiliate sharing 
that led to fraudulent activity. NationsBank shared with its affiliated securities company 
data on bank customers with low-risk, maturing federally-insured CDs.^^ The affiliate, 
NationsSecurity, then aggressively marketed high-risk investments to these 
consen/ative investors, misleading many customers to believe that the investments 
were as safe and reliable as federally-insured CDs. Many customers, including retired 
elderly, lost significant portions of their life savings. The Securities and Exchange 
Commission found that the companies intentionally blurred the distinction between the 
bank and the brokerage, and between the insured CDs and riskier investment products. 
When investment representatives of NationsSecurity called NationsBank's customers 
and indicated that they were with the "investment division” of the bank, many customers 
reasonably believed that they were bank employees, not brokers. 

NationsBank is not the only bank to have engaged in such a practice. Another 
example of inappropriate affiliate sharing involved First Union, which settled a private 
lawsuit alleging a similar scheme.^^ 

Corporate sharing of information with non-affiliated third parties has further 
demonstrated that federal laws governing these information flows are inadequate. 

Major financial institutions have used their customer lists to target consumers for 
fraudulent telemarketing schemes by sharing nonpublic financial information with third- 
party telemarketers. Capital One,^ Chase Manhattan,^^ Citibank,^® First U.S.A.,®^ Fleet 

Nationssecurities and Nationsbank, N.A., SEC Release No. 33-7532, May 4, 1998, available at 
http://www.sec.gov/litigation/admin/337532.txt. 

“ Risky Business in the Operating Subsidiary: How the OCC Dropped the Bail, Hearing Before the 
Subcommittee on Oversight and Investigations of the House Committee on Commerce, 106th Cong. 
(June 25, 1 999) (statement of Jonathan Aipert, Sr. Partner, Baker and Rodems). 

“ Office of the Washington State Attorney General, "Settlement with Discount Buying Ciub Highlights 
Privacy Concerns," Aug. 4, 2000, avaiiable at www.wa.gov/ago/releases/rel branddirect 080400.html. 

^ Id. 
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Mortgage,^® GE Capital,^® MBNA America,^ and U.S. Bancorp'*' all have provided their 
customers' personal and confidential information to fraudulent telemarketers. 

The financial institutions provided the telemarketers with the names, telephone 
numbers and other information about their customers. They also gave them the ability 
to charge customers' accounts without having to ask consumers to provide an account 
number. This practice, called preacquired account telemarketing, has subjected 
thousands of consumers to unauthorized charges for products and services they never 
wanted or ordered. In one case, during a thirteen-month period, a national bank 
processed 95,573 cancellations of membership clubs and other products that were 
billed by preacquired account telemarketers without customers’ authorization.'*^ 

in other cases, financial information flows have allowed businesses to defraud 
non-customers. This can occur where a bank sells consumers’ information, obtained by 
mining the information in its business customers’ accounts, to another business. For 
example, Charter Pacific Bank sold its database containing 3.6 million valid credit card 
account numbers to a convicted felon who then fraudulently billed the accounts for 
access to Internet pornography sites that the victims had never visited. Charter Pacific 
had not developed the database from the transaction and experience information about 
the consumers’ account, but had compiled it from transaction and experience 


National Association of Attorneys Generals, "Multistate Actions: 27 States and Puerto Rico Settle with 
Citibank," Feb. 27, 2002, available at http;/Avww.naag.org/issues/20020301-multi-citibank.php; Settlement 
document available at http://www.oag. state.ny.us/press^002/feb/feb27b_02_attach.pdf. 

Office of the New York Attorney General, "First USA to Halt Vendor's Deceptive Solicitations," Dec. 31 , 
2002, available at http://www.oag.state.ny.us/press/2002/dec/dec31a_02.html. 

^ Minnesota v. Fleet Mortgage Corp., 158 F. Supp. 2d 962 (D. Minn. 2001), available at 
http://www.ag.state.mn.us/consumer/PFyFleet_Opinion_61 901 .html. 

Office of the Washington State Attorney General. "Settlement with Discount Buying Club Highlights 
Privacy Concerns,” Aug. 4, 2000, available at 
http://www.wa.gov/ago/releases/rel branddirect 080400.html. 

"/d. 

Office of the Minnesota Attorney General, "Minnesota AG and U.S. Bancorp Settle Customer Privacy 
Suit," July 11,1 999, available at www.ag.state.mn.us/consumer/Privacy/Piypr_usbank_0701 1 999.html. 
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information about merchants that had accounts at Charter Pacific. The information 
included the date of sale, account number, and dollar amount of every credit card 
transaction processed by the bank's merchant customers. The unrestricted sharing of 
this information resulted in over $44 million of unauthorized charges. 

Finally, it must be noted that unrestricted sharing of information by and within 
corporate affiliate groups likely facilitates one of the nation's fastest growing white-collar 
crimes: identity theft.'*'* Many of these identity theft cases are "insider jobs," committed 
by employees who obtain access to and misuse individuals' personal information stored 
in their employers' databanks. According to recent comments submitted to the Federal 
Trade Commission,'*® researchers at Michigan State University studied over 1,000 
identity theft cases and found that victims in 50% of the cases specifically reported that 
the theft was committed by an employee of a company compiling personal information 
on individuals.^® Other reports note that many identity fraud cases stem from the 
perpetrator's purchase of consumers' personal information from commercial data 
brokers. Financial institutions’ information-sharing practices contribute to the risk of 
identity theft by greatly expanding the opportunity for thieves to obtain access to 
sensitive personal information. 


Supplemental Comments of the Minnesota Attorney General Office, FTC Telemarketing Saies Rule, 
FTC File No. R411001, http://www.flc.gov/os/comments/dncpapercomments/supplement/minnag.p<lf. 

Federal Trade Commission, "FTC Wins $37.5 Million Judgment from X-Rate Website Operator; Bank 
Sold Defendants Access to Active MasterCard, Visa Card Numbers," Sept. 7, 2000, available at 
http:/Aivww.ftc.gov/opa/2000/09/netfill.btm. 

For information on the growing problem of identity theft, see U.S, General Accounting Office, Identity 
Theft: Prevalence and Cost Appear to be Growing (GAO-02-363 March 2002); U.S. Federal Trade 
Commission, National and State Trends in Fraud and Identity Theft January - December 2002 (Jan. 22, 
2003); U.S. General Accounting Office, Identity Theft: Greater Awareness and Use of Existing Data Are 
Needed (GAO-02-766 June 2002 (surveying state laws enacted to combat identity theft). 

See Comments of the Electronic Privacy Information Center to the Federal Trade Commission 
Workshop on Information Flows, FTC File No. P034102 (June 18, 2003), at 23. 

Id., citing forthcoming study; results provided in email from Judith M. Collins, Ph.D., Associate 
Professor, Leadership and Management Program in Security School of Criminal Justice, Michigan State 
University to EPIC (Apr. 22, 2003, 18:13:35 EST) (on file with EPIC). 
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C. Notice to Consumers Under Federal Law Concerning Their Limited Rights 
to Disallow Sharing Among Coroorate Affiliates Are Woefully Inadequate 

Current privacy notices to consumers about their rights under federal law are 
woefully inadequate. In many circumstances consumer receive no notice about 
information flows. In circumstances where consumers do receive notices, consumers 
have been greatly confused by the dense information in the notices, which require a 
high education level to comprehend. As a result, consumers have not been adequately 
informed about their limited rights to opt out of information sharing among affiliates or 
with third parties. 

With respect to sharing credit reporting information among an affiliate group and 
sharing transaction and experience information with unaffiliated third parties, both GLB 
and the FCRA require that notices about the sharing practices and information about 
how consumers can opt out must be written in a “clear and conspicuous” manner.'”^ 
However, the opt-out notices provided by financial institutions in their effort to comply 
with GLB and the FCRA have not been “clear and conspicuous,” as those terms are 
commonly understood. Opt-out notices mailed by many financial institutions have been 
unintelligible and couched in language several grade levels above the reading capacity 
of the majority of Americans.'*® Mark Hochhauser, Ph.D., a readability expert, reviewed 
60 GLB opt-out notices and determined that these notices were written at an average 
3'® or 4"’ year college reading level, rather than the Junior high level comprehensible to 


15 U.S.C. § 6802(b)(1)(A); 15 U.S.C. § 1681a(dK2)(A)(iii). The federal regulatory agencies have not 
yet issued any guidance on how these two federal notice requirements work together. Many financial 
institutions have incorporated their affiiiate sharing notices required under the FCRA within their notices 
about sharing of information with unaffiiiated third parties required under GLB, 

“ See Robert O’Harrow, Jr., Getting a Handle on Privacy's Fine Print: Financial Firms’ Policy Notices 
Aren't Always ‘Clear and Conspicuous, ’ as Law Requires, The Washington Post, June 1 7, 2001 , at H-01 . 
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the general public."*® For example, the notice sent to customers by one financial 
institution stated: 

If you prefer that we not disclose nonpublic personal information about you to 
nonaffiliated third parties, you may opt out of those disclosures, that is, you may 
direct us not to make those disclosures (other than disclosures permitted by 
law).“ 

Surveys demonstrate that consumers either never see and read such 
complicated opt-out notices, or they don’t understand them.®’ 

The opt-out approach promulgated under GLB has proven so problematic that 
the federal agencies that administer the regulations under GLB convened an 
Interagency Public Workshop to address the concerns that have been raised “about 
clarity and effectiveness of some of the privacy notices” sent out under GLB.“ The 
agencies noted that consumers have complained that “the notices are confusing and/or 
misleading and that the opt-out disclosures are hard to find.”®® 

Where the vast majority of consumers do not even read opt-out notices, and 
those who read the notices cannot understand them, it cannot be said that they are able 
to understand their rights and exercise their choices intelligently. As a result, forty-one 
States, the District of Columbia, Puerto Rico, and the Virgin Islands called on the FTC 


“ Mark Hochhauser. Ph.D., "Lost in the Fine Prirrt: Readability of Financial Privacy Notices,” 
http://www.privacyrights.org/ar/GLB-Reading.htm (2001 ). 

“ See id. 

See Comments of 44 Attorneys General to Federal Trade Commission Regarding GLB Notices, dated 
February 15, 2002, available atwww.naag.org. 

“ Interagency Pubic Workshop, “Get Noticed: Effective Financial Privacy Notices,” 
http://viww.ftc.govrt)cp/workshops/glb/; see also Press Release, “Workshop Planned to Discuss Strategies 
for Providing Effective Financial Privacy Notices," www.flc.gov/opa/2001/09/glbwkshop.htm (Sept. 24, 
2001). 

“See Joint Notice Announcing Public Workshop and Requesting Public Comment, “Public Workshop on 
Financial Privacy Notices,” at 3. 
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and other federal regulatory agencies to create standard notices and require much 
simpler language so that consumers could understand them.^ 

III. STATES SHOULD BE ALLOWED TO CONTINUE TO REGULATE THE 

SHARING OF INFORMATION AMONG CORPORATE AFFILIATES 

Earlier this year, the National Association of Attorneys General adopted a 
resolution urging Congress to allow the limited preemption provisions contained in the 
1996 FCRA Amendments, including the preemption of affiliate sharing laws, to sunset 
as originally contemplated.^ In addition, in their bipartisan resolution,®® the State 
Attorneys General called upon Congress to refrain from enacting any new provision that 
would preempt the states from enforcing or enacting laws relating to the reporting of 
consumer credit information that provide greater consumer protection than in the federal 
law.®^ Congress should follow these recommendations. 

A. Congress Has Traditionally Allowed States to Enact Laws Governing 
Privacy. Credit, and Other Important Consumer Issues 

States have demonstrated the importance of their role as “laboratories of 
democracy" with respect to laws governing information flows within and among 
corporate structures. State legislatures have the ability to rapidly fashion local remedies 
to solve local problems arising with respect to such information flows.®® State laws 
governing health and medical information obtained by insurance companies, as well as 


^ See Comments of 44 Attorneys General to Federal Trade Commission Regarding GLB Notices, dated 
February 15, 2002, avaiiable at www.naag.org. 

“ Resoiution in Support of Fair Credit Reporting Reform (Nationai Association of Attorneys General), 
available at www.state.vt.us/atg/fair%20cred it%20reporting%20reform%20resolution.pdf. 

* The State Attorneys General consist of 20 Republicans and 31 Democrats, including the District of 
Columbia. A listing of their party affiliations can be found at iwww.naag.org/ag/full_ag_table.php, 

^ Resolution in Support of Fair Credit Reporting Reform, supra, n.55. 

See Hearing on Fair Credit Reporting Act: How It Functions for Consumers and the Economy, Before 
the Subcommittee on Financial Institutions and Consumer Credit, House Committee on Financial 
Services, 108"" Cong., June 4, 2003, (Statement of Vermont /tesistant Attorney General Julie Brill), at 4-5, 
10-14. 
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governing the sharing of information relating to specific diseases, are specific 
examples of responsible state enactments ensuring that corporations that obtain 
nonpublic health and financial information exercise their responsibilities with respect to 
such information with fairness, impartiality, and respect for consumers' right to privacy. 

This dual federal-state regulatory system for information flow allows states to 
innovate solutions to local problems as they arise, and informs the national debate over 
appropriate reguiatton of information flow. As the states' innovative solutions filter up to 
Congress, they can be considered for incorporation into the national baseline standards 
governing industry. 

Previous Congressional enactments relating to consumer protection issues have 
addressed the goal of national uniformity as well as the importance of allowing states to 
fashion remedies suited to local problems, by setting a national floor while permitting 
states to create additional or greater consumer protection provisions that are not 
inconsistent with federal law. The most recent example is GLB’s Section 507, allowing 
states to enact more protective laws with respect to sharing information with unaffiliated 
third parties. Other areas where Congress has specifically allowed states to enact more 
protective state laws include medical privacy,®® telecommunications,®’ telemarketing,®^ 
fair credit billing,®® equal credit opportunity,®* and subprime lending.®® Congress should 
employ the same strategy with respect to sharing of information among corporate 
affiliates. 

B. More Protective Privacy Laws Do Not Adversely Affect The Economy 
^ See Section IV, infra. 

“ Health Insurance Portability and Accountability Act, 104 Pub.L.No. 191, § 264 (1996). 

Telecommunications Consumer Protection Act, 47 U.S.C. § 227(e)(1). 

'^Telemarketing and Consumer Fraud and Abuse Prevention Act, 15 U.S.C, § 6101 etseq. 

® Fair Credit Billing Act, 15 U.S.C. § 1666). 

“ Equal Credit Opportunity Act, 15 U.S.C. § 1691 d(f). 
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Like several other states, Vermont has aggressively protected consumers’ 
privacy by enacting and enforcing numerous laws governing the sharing of financial 
information. Despite extensive regulation in this area by Vermont and several other 
states, the economies of these states have not been adversely affected. Indeed, 
Vermont consumers face some of the most favorable conditions for loan rates in the 
country. Moreover, credit is readily and speedily available in states that have enacted 
more protective laws. 

1. Extensive Vermont Regulation of Financial Privacy Is Not Limited to 
Affiliate Sharing. 

Vemnont’s law on affiliate sharing was part of an effort in 1992 by the Vermont 
Legislature to address credit reporting problems more globally. The resulting Vermont 
Fair Credit Reporting Act®® contains several important consumer protection provisions 
designed to address credit reporting problems that arose in Vermont.®^ These 
provisions include: consumer access to free credit reports;®® liquidated damages for 
consumers who are harmed;®® requiring consumer consent before any user can review 
a consumer credit report;^® allowing consumers to access their free credit reports by 
telephone;^’ and requiring credit reporting agencies to provide notices to consumers 
about these additional state rights.^® 


° Home Ownership and Equity Protection Act, 15 U.S.C, § 1640(e), 

9 V.S.A. § 2480a etseq.'. Act No. 246, 1991 (Ad). Sess.). 

For a discussion of the credit reporting problems faced by Vermont, see Hearing on Fair Credit 
Reporting Act: How It Functions for Consumers and the Economy, Before the Subcommittee on Financial 
Institutions and Consumer Credit, House Committee on Financial Services, 108'*’ Cong., June 4, 2003, 
(Statement of Vermont Assistant Attorney General Julie Brill). 

“9V.S.A.§2480c(a)(1). 

“ 9 V.S.A. § 2480f(b). 

™ 9 V.S.A. § 2480e(a)(2). Prescreened credit reports are excluded from Vermont’s consent provisions, 9 
V.S,A. § 2480e(cX2). 

9 V.S.A. §§ 2480b(b) and CF Rule 1 12.01 (available at wvirw.state.vt.us/atg/Rule%20CF1 12.htm). 
^^9V.S.A. §2480b(c). 



282 


The Vermont Legislature determined that these additional provisions are 
necessary to ensure that credit reports are accurate and are used in an appropriate 
fashion. The Vermont Attorney General’s Office has actively enforced these state 
consumer protection provisions with respect to both credit reporting agencies^® and 
credit grantors^'* over the past ten years. 

In addition to its more protective fair credit reporting laws, Vermont has also 
enacted more protective laws governing the sharing of nonpublic personal financial 
information, as allowed under Section 507 of GLB.^® In 1994, Vennont enacted a bank 
privacy opt-in law, prohibiting banks and other similar financial institutions from sharing 
nonpublic information unless the consumer consents.^® In 2001 , Vermont enacted 
regulations extending the opt-in requirements to the insurance and securities industry, 
and clarifying the regulations for the banking industry. 

2. The Economies of Vennont and Other States With Financial Privacy 
Regulations Have Not Been Adversely Impacted. 


” See, e.g.. In the Matter of Credit Bureau Services of Vermont, Inc., Docket No. 493-9-95WnCv (Wash. 
Cty. Sept 18, 1995) (violation of telephone number disclosure requirements); In the Matter of Equifax 
Credit Information Services, Inc., Docket No.492-9-95WnCv (Wash. Cty. Sept. 18, 1995) (same); In the 
Matter of TRW Inc., Docket No. 491-9-95WnCv (Wash. Cty. Sept. 18, 1995)(same); In the Matter of 
Equifax Credit Information Services, Inc., Docket No. 51-1-OOWnCv (Wash. Cty. Jan 27, 2000) (failure to 
institute reasonable procedures to ensure maximum possible compliance with Vermont’s law requiring 
users to obtain consumer consent prior to using credit reports). 

” Coburn and Feeley Property Management, (Wash. Cty. July 17, 1995)(property management firm 
obtained credit reports on tenants without tenants' consent; In the Matter of MCI Communications 
Corporation, Docket No. 171-4-98WnCv (Wash. Cty. April 2, 1998) (telecommunications company failed 
to obtain consumer consent from over 12,000 Vermont consumers prior to using their credit report); in the 
Matter of Alliant Foodservice Inc., Docket No. 116-3-OOWnCv (March 1,2000)(food service company 
failed to obtain consumer consent prior to using consumer credit report, and failed to have a permissible 
purpose under federal law); In the Matter of May Department Stores Company, Docket No. 605-1 1-01 
WnCv (Wash. Cty. Nov. 15, 2001)(department store chains failed to adequately obtain consumer consent 
prior to using consumer credit report). 

15 U.S;C. § 6807(b), which provides that the federal Gramm-Leach-Billey law does not supersede any 
slate provisions on privacy except to the extent that they are "inconsistent" with privacy provisions of 
GLB, and further provides that state laws are not “inconsistent" to the extent that they afford greater 
consumer protection than provided under GLB, 

™8V.S.A.§ 10201 elseq. 

” The banking opt-in regulation can be found at; www.state,vt.us/atg/lnsurance%20ADOPTED% 
20ruie.pdf. The insurance opt-in regulation can bo found at 

www.state.vt.us/atg/lnsurance%20AD0PTED%20rule.pdf , Vermont's opt-in regulations became 
completely effective on February 1 7, 2002. 
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In his testimony filed with the House Subcommittee on Financial Institutions and 
Consumer Credit last month, Fordham University Law Professor Joel Reidenberg 
demonstrated that lenders make better credit decisions in Vermont. California, and 
Massachusetts, three of the states with more protective laws that were specifically 
“grandfathered” under the 1 996 FCRA Amendments/® Vermont has the lowest level of 
consumer bankruptcies in the nation, Massachusetts is the next lowest with a rank of 
49®', and California is below the national median with a rank of 27“'/® Professor 
Reidenberg also notes that consumer interest rates are below the national median in all 
three of these states.®'^ 

In addition to the data cited by Professor Reidenberg, there are other data that 
demonstrate that the economies of Vermont. Massachusetts and California have not 
been harmed by enactment of more protective laws. Auto loan rates are similarly low in 
these three states: Vermont ranks 50“’ in the country, meaning that its auto loan rates 
are next to the lowest; California ranks 31“' in the country; and Massachusetts ranks 
24“', just about at the national median.®'* 

A chart of the bankruptcy, mortgage loan and auto loan rates for California, 
Massachusetts and Vermont is attached to this testimony as Exhibit 4. 

Moreover, credit is widely available in these states, and available without delay. 
Exhibit 5 contains loan advertisements placed in Vermont’s three major daily 

™ Hearing on the Importance of the National Credit Reporting System to Consumers and the U.S. 
Economy Before the Sutrcommittee on Financial Institutions and Consumer Credit, House Committee on 
Financial Services, 108'“ Cong., May 8, 2003. (Statement of Prof. Joel Reidenberg at 3). 

” Id., citing American Bankruptcy Institute, U.S. Bankruptcy Filing Statistics: Households per filing, Rank 
g003), available at wvw.abiworld.org/stats/housholdrank.pdf. 

“ Statement of Prof. Joel Reidenberg, supra note 78 at 3. 

®'48-month new car loan rates as of May 2003, available 8t 

http://bankrate.com/brm/graphs/graph_trend.asp?product=1&prodtype=M&ad=mlg&nav=mtg30year_grap 

h. 
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newspapers over the ten-day period of May 19 through May 29, 2003. As the ads 
demonstrate, “zero percent” financing and instant credit for mortgages, car loans, and 
personal loans are widely available in Vermont. 

It is important not to overstate the relevance of this data. It cannot be said, for 
example, that the more protective laws in Vermont, California, and Massachusetts 
cause these more favorable economic conditions. As Professor Reidenberg notes, 
there may be other factors at play, such as state unemployment data for bankruptcy 
filings and non-interest transaction costs for mortgages.^ However, these data appear 
to demonstrate that the economies of these states have not been adversely affected by 
their more protective credit reporting laws. 

The absence of an apparent adverse impact upon Vermont’s economy is 
particularly interesting because of the breadth of state laws governing credit reporting 
and financial privacy. None of Vermont’s more protective laws appear to have 
adversely affected Vermont’s economy. 

* * it 

In sum. Congress has recognized the important role of states in the dual 
regulatory system governing information flow among corporate affiliates by allowing for 
limited preemption in the 1996 amendments, and calling for the termination of those 
preemption provisions on December 31 , 2003. Nothing has changed since 1996. The 
states continue to enforce both federal and state laws with respect to sharing of 
information among corporate affiliates, as well as with respect to credit reporting 
agencies, furnishers of credit information, and users of credit reports. The states 
continue to play a vital role in the dual regulatory system governing information flow in 

statement of Prof. Joel Reidenberg, supra note 78, at 4. 
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the nation's economy. The states should be allowed to continue to serve as 

laboratories of democracy, fashioning local remedies to local problems that can be 

considered by Congress for implementation on a national level. The limited preemption 

provisions contained in the 1996 Amendments should sunset as originally 

contemplated, and Congress should not enact new preemption provisions. 

IV. FCRA’S PREEMPTION DOES NOT BAR THE STATES FROM ENACTING 
ANY LAWS RELATING TO AFFILIATE SHARING 

Congress never intended that the affiliate sharing provisions contained in the 
FCRA would prohibit the states from enacting any laws governing sharing of information 
among corporate affiliates. Rather, the FCRA’s preemption provision governing affiliate 
sharing is intended merely to prohibit the states from enacting laws that would deem the 
sharing of information among affiliates to be the activity of credit reporting agencies. 
Outside this limited area, under GLB, states should be free to enact laws governing the 
extent to which and manner in which affiliates may share information. 

A. The FCRA Regulates Only Consumer Reports And Consumer Reporting 
Agencies 

The FCRA regulates only the compilation, dissemination, and use of “consumer 
reports,” a term defined to include any communication by a “consumer reporting 
agency” of information bearing on specified characteristics used as factors in 
determining a consumer’s eligibility for credit or other FCRA-authorized purposes.®^ 
“Consumer reporting agencies” are defined as persons regularly furnishing 
consumer reports to third parties.®^ The FCRA restricts the furnishing of consumer 


“15U.S.C. §1681a(d), 
“15U.S.C. § 1681a(f). 
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reports to recipients with a “permissible purpose" for the information, such as 
lenders.®® If information does not constitute a consumer credit report, it is not 
governed by the Act - or by its preemption provisions.®® 

Nothing in the FCRA itself regulates or authorizes the sharing of information 
that is not a “consumer report," including information subject to GLB.®^ Section 603 
of the FCRA, titled “Exclusions,” states that “[t]he term 'consumer report’ does not 
include” - and therefore the Act does not regulate - the sharing of both transaction 
and experience information and affiliate sharing of “other" information where the 
consumer is given notice and opportunity to opt out.®® 

Section 624(b)(2) of the FCRA, the affiliate sharing preemption provision, simply 
confirms and extends to state credit reporting laws this exclusion of “the exchange of 
information among persons affiliated by common ownership or common corporate 
control.”®® That is, the subject matter of affiliate sharing is “excluded” from the statute’s 
requirements, not immunized from regulation by other statutes. Thus, the FCRA’s 
affiliate-sharing “preemption” provision extends as far as, and no further than, the scope 
of the rest of the FCRA - it affects only the regulation of “consumer reports” and 
“consumer reporting agencies.” 

Any interpretation of the FCRA’s affiliate-sharing preemption provision must 
place the measure within the context of the rest of the statute.®® Section 624(b)(2), 


“15U.S.C. §1681b(a). 

See Individual Reference Setv. Group, Inc., v. FTC, 145 F. Supp. 2d 6 at 17 (D.D.C. April 2001) (“The 
FCRA does not regulate the dissemination of information that is not contained in a 'consumer report.”). 

" See Privacy of Consumer Financial Information, 65 Fed. Reg. 33,646, at 33,668 (May 24, 2000) 
(codified at 313 C.F.R. pt. 313). 

“15U.S.C. §1681a(d)(2). 

15 U.S.C. § 1681t(b)(2). Indeed, the Vermont law that is explicitly exempted from preemption, 9 V.S.A, 
5 2480e, is just such a credit-reporting statute. 

* See FDA v. Brown & Williamson Tobacco Co., 529 U.S. 120, 133 (March 2000). (It is a “fundamental 
canon of statutory construction that the words of a statute must be read In their context and with a view 
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taken out of context, may suggest broad preemptive scope: “No requirement or 
prohibition may be imposed under the iaws of any State . . . with respect to the 
exchange of information among persons affiiiated by common ownership or common 
corporate control.” But it is improper to attempt, as the financial services industry has 
done in the challenge to the California local laws governing financial privacy,®' to 
remove this provision from its limited, credit-reporting context and assert that “the laws 
of any State” refers to any law, not just laws governing credit reporting. After all, the 
provision at issue forbids state laws regulating the “exchange of information” among 
affiliates. If context plays no role, then the FCRA could be held to prohibit a state law 
limiting or regulating the exchange of any kind of infomnation under any circumstances, 
not just the type of information and activity regulated by the FCRA; under such a 
strained reading, state statutes prohibiting conspiracy, dissemination of stolen trade 
secrets, defamation, and a host of other types of “information” that could be 
“exchanged” would be preempted.®^’ 

B. A Broader Reading of the FCRA Preemption on Affiliate Sharing Would 

Vitiate Congress' Intent to Allow States to Protect Health Information Held bv 
Insurance Affiliates From InaDoropriate Use By The Insurers’ Affiliates 

The industry's interpretation of FCRA’s affiliate sharing preemption provision in 
the California case vitiates Congress’ clear intent that the states be allowed to regulate 


to their place in the overall statutory scheme”); Exxon Mobil Corp. v. EPA, 217 F.3d 126 at 1249 (Ca. 9, 
2000 ). 

See, e g.. Plaintiff National Banks' Motion for Summary Judgment and in Support of Defendant 
Municipatities' Motion for Summary Judgment, Bank ot America, N.A. v. City of Daly City, USDC No. C 02 
4343 CW (N.D. CA May 23. 2003). 

See New York State Conf. of Blue Cross & Blue Shield Plans v. Travelers Ins. Co., 514 U.S. 645, 656 
(1995) (cautioning courts to avoid "uncritical literalism"); Lungren v. Deukmejian, 45 Cal. 3d 727, 735 
(June 1998). (“Literal construction should not prevail if it is contrary to the legislative Intent apparent In the 
statue”). 

” Section IVA is drawn from arguments put forth in Memorandum Amicus Curiae of the Attorney General 
of the State of California in Opposition to Plaintiff National Banks’ Motion for Summary Judgment and in 
Support of Defendant Municipalities’ Motion for Summary Judgment, Bank of America, N.A. v. City of Daly 
City, USDC No. C 02 4343 CW (N.D. CA May 23, 2003). 
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health information held by insurance companies within a corporate affiliate group. 
Indeed, if industry were successful in its strained argument for a broader interpretation 
of the FCRA’s affiliate sharing preemption provision, the result would be that corporate 
affiliates would be entitled to make credit decisions and other financial decisions based 
upon health information heid by an affiliated insurance company. Such a strained 
reading of the affiiiate sharing preemption provision thus would frustrate Congressional 
reliance on state regulation in this area, as contemplated under both GLB and HIPAA, 
to protect consumers from such inappropriate use of their heaith information. 

Recognizing that insurance providers are appropriately regulated by the states. 
Congress, in enacting GLB, called upon state insurance authorities to adopt 
implementing regulations regarding disclosure of nonpublic financial information held by 
insurance companies.®^ In response to Congressional reliance on state regulation in 
this area, 35 states and the District of Columbia have adopted the 2000 Model Privacy 
Regulation drafted by the National Association of Insurance Commissioners.®® The 
NAIC 2000 Model Regulation establishes an opt-out for sharing of nonpublic financial 
information by an insurance company, and an opt-in for sharing health information.®® 
The NAIC 2000 Model Regulation contains no exception for sharing health information 
with affiliates. Under the NAIC 2000 Model Regulation, insurers must give consumers 
notice and an opt-in choice before sharing health information within their affiiiate group. 

There are many other state laws that govern the extent to which specific types of 
health information may be shared with anyone, whether inside the corporate affiliate 

** See GAO, Financial Privacy: Status of State Actions on Cramm-Leach-Bliley Act’s Privacy Provisions 
(GAO 02-361 April 2002), at 1-2. 

“ Id. at 3. All but one of the remaining states have adopted an earlier version of the NAIC Model 
Regulation. 

Id. at 6-8. Two states - Vermont and New Mexico - substituted an opt-in requirement for all 
information held by insurers, including nonpubllc financial information. 
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group or outside. HIV testing and genetic testing are two areas where many states 
have enacted laws severely limiting the disclosure of testing results. Many of these 
state laws would prohibit the disclosure of this information by an insurer to its banking 
affiliate for the purpose of credit decisions.®^ 

These state laws provide crucial consumer protections not available under the 
federal Department of Health and Human Services’ Health Privacy Rule, promulgated 
under the Health Insurance Portability and Accountability Act (HIPAA). The HIPAA 
Privacy Rule has limited applicability and covers only health care providers that transmit 
claims-type information electronically, health plans, and health care clearinghouses. 
HIPAA does not apply to most of the entities currently allowed to affiliate under GLB, 
nor does it govern credit reporting agencies, credit report users, and furnishers of 
information regulated by FCRA. HIPAA does not apply to banks, life insurers, or 
property and casualty insurers, despite the fact that these institutions often obtain 
sensitive medical information from consumers, and may now affiliate with each other 
under one corporate umbrella. It cannot be said that Congress intended to preempt 
state laws governing the sharing of medical information by such entities through the 
FCRA’s provision, when both GLB and HIPAA rely upon the states to provide important 
consumer protections for such sensitive information. 

* * * 

In sum, FCRA's preemption of state credit reporting laws that govern affiliate 
sharing cannot be read as preempting all state laws governing affiliate sharing. The 
California courts have not yet decided whether the industry’s arguments in the California 

See, e.g. Del. Code Ann. tit. 18, § 7404 (Delaware HIV testing disciosure statute); Fia. Stat. Ann § 
627.429 (Fiorida HIV testing disclosure statute); Ga. Code Ann. § 33-54-3 (Georgia genetic testing 
disclosure statute); Md. Ins. Code § 27-909 (Maryland genetic testing disclosure statute). 

“45 C.F.R. Part 164. 
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case are specious. Congress has the prime opportunity to put an end to the financial 
industry's obfuscation on this point by allowing the preemption provisions contained in 
the FCRA to sunset as originally contemplated. Removing the FCRA’s preemption 
provision makes it perfectly clear that states may enact laws governing the extent to 
which and manner in which financial and health information may be shared regardless 
of whether such sharing is with an affiliate or third party. 


Due to the quality of the exhibits that follow 
this original statement, they have been held 
in Senate Banking Committee files. 
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PREPARED STATEMENT OF MARTIN WONG 

General Counsel, Global Consumer Group, Citigroup 
June 26, 2003 

Good morning. Chairman Shelby, Ranking Member Sarbanes, and Members of the 
Committee. My name is Martin Wong and I am the General Counsel of Citigroup’s 
Global Consumer Group. On behalf of Citi^oup, I want to thank Chairman Shelby 
for holding these hearings on the Fair Credit Reporting Act (FCRA) and I appreciate 
the opportunity to speak before you today to discuss how the FCRA, and particu- 
larly the affiliate sharing provisions, impact our ability to operate efficiently and 
serve our over 200 million customer accounts. 

As one of the largest diversified financial services companies in the United States, 
Citigroup has extensive experience with the FCRA and has a significant interest in 
seeing that it continues to operate successfully. Citigroup currently serves customers 
in all fifty States and over 100 countries. Citigroup has long been a leader in using 
the information available through the credit reporting system to provide credit op- 
portunities to customers at all income levels through a diverse range of financial 
products and services, including credit cards, mortgages, consumer finance, student 
loans, and auto loans. We also offer noncredit products, including retail banking, 
private banking, life insurance and annuities, asset management, and investment 
products. 

Today, I want to emphasize the importance that Citigroup attributes to making 
permanent the national standards contained in the FCRA. The FCRA provides a na- 
tional framework for the credit reporting system, which has been shown to work 
well and to provide substantial economic benefits to consumers, including affordable 
and convenient credit, wide credit availability, and prevention of fraud and identity 
theft. The FCRA appropriately balances consumer protections with the crucial need 
for creditors to have access to a uniform national database on which to make credit 
decisions. The FCRA also facilitates the free flow of information that allows modern 
financial services companies to work efficiently. It is essential, therefore, that Con- 
gress act to preserve all of the provisions of this uniform national framework that 
are scheduled to expire at the end of this year. 

While Citigroup believes that maintaining national uniform standards for all 
seven of the expiring provisions of the FCRA is crucial, I will focus my testimony 
on the topic of today’s hearing — information sharing among affiliates — and why pre- 
serving the uniform national standards for affiliate sharing is critical to our contin- 
ued ability to serve our customers well. 

Reasons for Affiliate Structure 

From a technical perspective, Citigroup is, indeed, a financial services holding 
company comprised of approximately 1,900 legal entities. However, the majority of 
these entities are established or retained for legal, regulatory, or tax purposes. For 
example, in the insurance agency and mortgage businesses. State registration re- 
quirements make it prudent and convenient to be separately incorporated in most 
States for licensing purposes. Additionally, many of our affiliates do business only 
with Government or corporate entities or exist solely to house certain assets. Only 
a small number of these entities actually transact business with customers, and all 
of them are limited by the Gramm-Leach-Bliley Act (GLB) to the provision of finan- 
cial services in one of three lines of business — banking, insurance, and securities. 
For the customers who conduct business with us, the existence of these affiliates 
is invisible and irrelevant. Therefore, when viewed from the customer’s perspective, 
Citigroup is a single provider of financial services. 

How We Share Information to Better Serve Our Customers and Run Our 
Business More Efficiently 

Information sharing among affiliates is an ingrained part of how we meet our cus- 
tomers’ needs and expectations on a daily basis. The process is so seamless that cus- 
tomers are often unaware of the connection between the free flow of information and 
the significant benefits they receive. 

Affiliate Sharing Is Necessary for Effective Credit Underwriting and Credit 
Monitoring, Which Are at the Heart of the National Credit Reporting System 

The sharing of information among affiliates enhances the ability of lenders to ac- 
curately assess credit risk, thereby reducing their overall risk of loss. Citigroup is 
able to use the credit information and transaction histories that we collect from af- 
filiates to create internal credit scores and models that help determine a customer’s 
eligibility for credit. This information supplements credit reports and FICO scores 
to paint the most accurate picture possible of a customer. For example, CitiMortgage 
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underwriters have access to information from affiliates that includes a customer’s 
deposit, loan, and brokerage account balances, as well as the customer’s payment 
history and available lines of credit. This allows our credit analysts to verify the 
customer’s creditworthiness quickly and efficiently, minimizing the burden on the 
customer associated with providing this documentation. 

Sharing of credit information and transaction histories also allows us to extend 
credit to traditionally underserved populations and reduces the costs for those with 
better credit histories. The quality, quantity, and timeliness of customer credit infor- 
mation available through affiliate sharing greatly reduces the opportunities for mis- 
takes in the granting of credit to the benefit of customers and lenders. 

Affiliate sharing is also important for credit monitoring. Many of our credit card 
customers have multiple cards with us and those cards will often be issued by more 
than one affiliate. We can order a single credit report to monitor credit behavior 
across all cards, leading to increased efficiencies and lower costs. This cross-affiliate 
monitoring allows us to reach out to customers who are starting to have problems 
and offer appropriate assistance. 

Sharing Information Among Affiliates Greatly Assists in the Prevention and 
Detection of Identity Theft and Fraud 

Although some have argued that sharing information increases opportunities for 
identity theft, our experience is that information sharing among affiliates actually 
reduces identity theft. Through affiliate sharing, we are able to maintain an inter- 
nal fraud database, which helps prevent the opening or maintenance of fraudulent 
accounts. This kind of information sharing also allows us to alert customers to po- 
tential fraud or identity theft at an earlier stage. The sooner we detect the fraud, 
the sooner we can notify the customer, minimizing the effect on the victim. Finally, 
sharing information among affiliates makes it easier to assist law enforcement to 
build a strong case for prosecution 

Additionally, Citigroup has policies and procedures in place to reduce the threat 
of internal misuse of this information. For example, most of our businesses have 
internal fraud investigation units; access to sensitive information is given to employ- 
ees only on a “need to know” basis; we have policies concerning the handling of sen- 
sitive information by our employees; and we separate certain key responsibilities 
among employees to reduce the potential for fraud. 

Affiliate Sharing Allows Us To Provide One-Stop-Shopping for Our Customers in a 
Way That Is Seamless and Consistent with Our Customers’ Expectations 

Affiliate sharing allows companies like Citigroup to better serve our customers’ di- 
verse financial needs through affiliates that have appropriate products and services. 
Consumers who choose to do business with Citigroup expect easy access to the full 
array of financial products we offer. Our customers want and expect the convenience 
of having one-stop-shopping for all of our products — banking, insurance, home mort- 
gage, credit cards, and securities. They also expect the ability to access information 
about all of their accounts on one statement, with one phone call, or on one website. 
For example, customers who use our Financial Centers can link their checking ac- 
count from Citibank, N.A., credit card account from Citibank South Dakota, mort- 
gage account from CitiMortgage, and brokerage account from Citicorp Investment 
Services, Inc. 

Additionally, consolidated relationships allow customers to move money 
seamlessly between accounts and to pay their Citibank credit card balances at any 
Citibank ATM, as well as on the Internet, simply by making a transfer between ac- 
counts. The amount will be credited that same day, which allows customers to avoid 
additional interest and late fees. Customers can also execute trades and transfer 
money from their checking account to their investment-linked money market prod- 
ucts online. 

Affiliate sharing also allows us to provide seamless service for our customers. Cus- 
tomers do not view us as different legal entities, but instead as a single source of 
multiple financial products. When a Citibank customer who has an account in Con- 
necticut (through our Federal thrift — Citibank FSB) enters a Citibank branch in 
New York (our national bank — Citibank, N.A.) to cash a check or open another ac- 
count, the customer expects to be recognized and receive the same level of service. 
The legal distinction between the two affiliated Citibanks is not relevant to the cus- 
tomer and it should not affect his or her ability to obtain products and services. 

Affiliate Sharing Provides Customers with Pricing Discounts and Products 
Tailored to Their Needs 

For customers who have multiple account relationships with us, the sharing of in- 
formation between affiliates allows us to provide financial benefits in the form of 
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relationship pricing and special offers. For example, many customers benefit from 
no-fee checking through Citibank, N.A. or Citibank FSB based upon their total com- 
bined balances in their mortgage from CitiMortgage, credit card from Citibank 
South Dakota, and investments through Citicorp Investment Services, Inc. The com- 
bined balance also permits customers to receive better rates on investment products. 
After recent acquisitions, we reached out to customers to help them link their ac- 
counts for this benefit. We could not have done that without the ability to share 
information across affiliates. 

Sharing information among affiliates also permits us to service our customers on 
an individualized or tailored basis. Information about our experience with a par- 
ticular customer can be used among our affiliates to provide the customer with more 
suitable products and services. For example, customers with a Smith Barney broker- 
age account are eligible for a mortgage from CitiMortgage without a down payment 
by directly pledging securities in their account as collateral. This allows the cus- 
tomer to avoid having to sell at what may be an inopportune time and to continue 
to receive the interest or dividends on the securities. Similarly, a customer who 
maintains a high balance on a Citibank credit card may be informed that he can 
reduce the interest rate he is paying and possibly get tax benefits by transferring 
the balance to a secured home equity loan through an affiliate bank. 

In the absence of affiliate sharing, Citigroup would know decidedly less about our 
customers’ financial needs, making it more difficult to identify and service those 
needs. 

FCRA Contains the Appropriate Balance 

In 1996, Congress struck the appropriate balance between consumer protection 
and business needs by allowing customers to opt out of having certain information 
shared among affiliated entities, but continuing to allow information about a com- 
pany’s own experiences with a customer to be shared freely among affiliates. This 
national standard has worked well for 7 years. The FCRA national standard is par- 
ticularly reasonable now that the business of providing financial services, especially 
lending, is no longer restricted by State borders, which means that consumers have 
the same opportunities for credit, regardless of where they live. 

Given the fact that 16 percent of the U.S. population moves every year, and that 
many of our customers work in one State and live in another, have vacation houses 
in different States, or attend college in a different State for part of the year, it 
would be a significant technical challenge to determine the appropriate treatment 
of customer information in the face of inconsistent State laws. 

Our experience has shown that opt outs provide our customers with all the choice 
they need to control the use of their personal information. Citigroup has been pro- 
viding customers with the ability to opt out of information sharing, in one form or 
another, for over 15 years. Citigroup businesses have significantly different opt out 
rates depending on a variety of factors, including products and services offered and 
the length and nature of the customer relationship. This significant variation dem- 
onstrates that opt outs work. Our customers are making informed choices about the 
kinds of information they want to share, and the kinds they do not. 

However, the majority of our customers still prefer the free flow of information 
that results in enhanced products and services. Opt ins function as de facto prohibi- 
tions on information sharing, particularly for existing customers. They do not pro- 
mote customer choice — rather, they eliminate it. 

Conclusion 

If different States were allowed to pass laws governing the exchange of informa- 
tion among affiliates, it would significantly disrupt our seamless, nationwide system 
of serving our customers. It could lead to a never-ending process as States and local- 
ities impose different regimes. Compliance with this patchwork of laws would be ex- 
tremely burdensome and costly for lenders, and ultimately for consumers. 

We believe that Congress must act this year to make permanent the uniform 
standards established under the FCRA. It has created more competition in the fi- 
nancial services industry and allowed companies to better serve their customers 
through more widely available, affordable, and convenient credit. 

Thank you again for the opportunity to appear before this Committee. I would be 
pleased to answer any questions you may have. 
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Chairman Shelby, Senator Sarbanes, and Members of the Committee, on behalf 
of the nonprofit, nonpartisan. State-based Public Interest Research Groups, U.S. 
PIRG is pleased to offer you this testimony on affiliate sharing practices and the 
Fair Credit Reporting Act (FCRA). Among the most important matters before this 
Congress is review of the impact of the 1996 exception to the definition of credit 
report allowing companies to share customer experience and transaction information 
among corporate affiliates outside the major consumer protections of the FCRA. 

Our testimony also discusses the relationship between the FCRA and the 1999 
Gramm-Leach-Bliley Financial Services Modernization Act (GLB) and attempts by 
industry to chill efforts by cities and States to enact stronger financial privacy laws, 
as GLB clearly allows under the Sarbanes States’ Rights Amendment. 

In addition to presenting our views on the problems caused by unregulated and 
under-regulated information sharing by and among corporate affiliates and unaffili- 
ated third parties, we urge the Congress not to extend the FCRA’s temporary 1996 
partial preemption provisions. The FCRA itself does not need to be reauthorized; ex- 
tension of preemption is an optional decision by the Congress that, in our view, re- 
verses clear Congressional intent from 1996 that preemption be temporary. 

Summary 

Congress enacted in 1970 a comprehensive scheme for regulating the sharing of 
detailed information by credit bureaus under the Fair Credit Reporting Act. Yet, 
through a 1996 exception, it created a new class of unregulated affiliate sharing 
transactions. Sharing of confidential consumer information among affiliates is not 
regulated under the FCRA nor under the Gramm-Leach-Bliley Act. The latter Act 
simply requires notice of affiliate and third party information sharing practices and 
provides a modest opt out in an extremely limited subset of third-party transactions. 
In the post-GLB marketplace, this failure to regulate a growing class of transactions 
involving confidential consumer information and decisionmaking is troubling. While 
we have enacted comprehensive standards for regulating credit reports, we have no 
standards for regulating affiliate sharing. 

Industry, in a series of hearings before this Committee and the House Financial 
Services Committee, has failed to make the case for a continued exception from reg- 
ulation for affiliate information sharing. 

Industry has also claimed, without proof, that unregulated information sharing 
provides billions of dollars of benefits to the economy and, again with proof, that 
providing consumers with greater privacy rights will eliminate those alleged bene- 
fits. Industry has also claimed that providing consumers with privacy protection will 
prevent them from stopping fraud or completing transactions on consumer accounts. 
Neither claim is true. The industry also infers that consumer groups are for “harsh” 
opt in rules, but that the pro-consumer industry would support a more reasonable 
opt out privacy mechanism. In fact, sharing under the Gramm-Leach-Bliley Act is 
largely based on a notice only, no opt regime. The vast majority of the financial 
services industry prefers no opt even to modest opt out protections. 

The Fair Credit Reporting Act Strictly Regulates Information-Sharing 
by Credit Bureaus under The Fair Information Practices, But Allows 
Companies A Sweeping Affiliate-Sharing Exception to the Definition 
of Credit Report 

The Fair Credit Reporting Act, Its History and the Fair Information Practices 

I want to state clearly at the outset that the FCRA is an important consumer pro- 
tection and privacy law. It plays a critical role in helping consumers obtain opportu- 
nities in the marketplace. The 1970 Act recognized the importance to the economy 
of the third-party credit reporting system, but it also recognized the importance of 
accurate credit reports and the protection of privacy. Yet, despite the 1996 attempts 
to update the law to improve it, the law still suffers from numerous problems^ in 
addition to its affiliate-sharing exception, the subject of today’s hearing. 


iPor example, other problems with the FCRA include a lack of adequate Federal agency en- 
forcement, unacceptable limits on private enforcement, an utter disdain for compliance by many 
creditors when they furnish information to credit bureaus, the failure by the consumer reporting 
industry to maintain adequate accuracy standards, and the disconnect in the credit granting 
process that has led to the identity theft epidemic. See U.S. PIRG’s testimony before the House 
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The FCRA was enacted ^ in 1970 in the wake of a series of scandals involving un- 
fair insurance investigations. Congress also recognized an increasing inability of 
consumers to obtain redress when credit mistakes were made. The 1970 Act created 
a broad structure for regulating consumer reporting agencies (CRA’s, or credit 
bureaus). 

The FCRA’s general structure is based on the Code of Fair Information Practices,^ 
which were later described by a 1973 Health, Education, and Welfare (HEW) task 
force and embodied into the 1974 Privacy Act,^ which regulates Government uses 
of information. The Fair Information Practices require data collectors to collect only 
limited information; to use it only for specified purposes, unless consent of the data 
subject is granted for secondary uses; to protect the security, accuracy, and privacy 
of that information; to make information practices transparent to subjects; to grant 
data subjects the rights to inspect, correct, and dispute records about them; and to 
grant data subjects the right to enforce these rights. 

For example, the FCRA allows credit bureaus — which are clearly third parties 
without a direct relationship with consumers — to obtain detailed information from 
public records, creditors, and even subjective interviews and then to engage in wide- 
spread trafficking in detailed credit dossiers containing a consumer’s most intimate 
financial details. 

But, the FCRA strictly regulates that trafficking through its comprehensive struc- 
ture, based on the Fair Information Practices. It requires credit bureaus to employ 
reasonable procedures to ensure the “maximum possible accuracy” of credit reports. 
It limits the use of credit reports only to users with a permissible purpose. It gives 
consumers a series of rights, including a right to inspect the reports (for free after 
denial of credit) and to dispute errors. It gives consumers a right to learn when 
their reports have been used adversely, for example to deny them credit or insur- 
ance. It gives consumers the right to sue bureaus that make mistakes or refuse to 
fix them, but it tempers that right with strong affirmative defenses and defamation 
immunity for the CRA’s. 


Subcommittee on Financial Institutions, 4 June 2003, at http:llfinancialservices.house.govl 
media / pdf! 060403em.pdf. 

2 15 U.S.C. 1681 etseq. 

^ Ideally, consumer groups believe that all privacy legislation enacted by either the States or 
Congress should be based on Fair Information Practices, which were originally proposed by a 
Health, Education, and Welfare (HEW) task force and then embodied into the 1974 Privacy Act 
and into the 1980 Organization for Economic Cooperation and Development (OECD) guidelines. 
The 1974 Privacy Act applies to Government uses of information. Consumer and privacy groups 
generally view the following as among the key elements of Fair Information Practices: (1) Collec- 
tion Limitation Principle: There should be limits to the collection of personal data and any such 
data should be obtained by lawful and fair means and, where appropriate, with the knowledge 
or consent of the data subject. (2) Data Quality Principle: Personal data should be relevant to 
the purposes for which they are to be used, and, to the extent necessary for those purposes, 
should be accurate, complete and kept up-to-date. (3) Purpose Specification Principle: The pur- 
poses for which personal data are collected should be specified not later than at the time of data 
collection and the subsequent use limited to the fulfillment of those purposes or such others as 
are not incompatible with those purposes and as are specified on each occasion of change of pur- 
pose. (4) Use Limitation Principle: Personal data should not be disclosed, made available or oth- 
erwise used for purposes other than those specified in accordance with the Purpose Specification 
Principle except: (a) with the consent of the data subject; or (b) by the authority of law. (5) Secu- 
rity Safeguards Principle: Personal data should be protected by reasonable security safeguards 
against such risks as loss or unauthorized access, destruction, use, modification, or disclosure 
of data. (6) Openness Principle: There should be a general policy of openness about develop- 
ments, practices, and policies with respect to personal data. Means should be readily available 
of establishing the existence and nature of personal data, and the main purposes of their use, 
as well as the identity and usual residence of the data controller. (7) Individual Participation 
Principle: An individual should have the right: (a) to obtain from a data controller, or otherwise, 
confirmation of whether or not the data controller has data relating to him; (b) to have commu- 
nicated to him, data relating to him within a reasonable time; at a charge, if any, that is not 
excessive; in a reasonable manner; and in a form that is readily intelligible to him; (c) to be 
given reasons if a request made under subparagraphs (a) and (b) is denied, and to be able to 
challenge such denial; and (d) to challenge data relating to him and, if the challenge is success- 
ful to have the data erased, rectified, completed, or amended. (8) Accountability Principle: A 
data controller should be accountable for compl 3 dng with measures which give effect to the prin- 
ciples stated above. This analysis derived from Robert Gellman, “Privacy, Consumers, and Costs: 
How The Lack of Privacy Costs Consumers and Why Business Studies of Privacy Costs are Bi- 
ased and Incomplete,” March 2002, http: I lwww.epic.orglreportsldmfprivacy.html or http:ll 
www.cdt.org I publications I dmfprivacy.pdf which also discusses in detail the OECD Council Rec- 
ommendations Concerning Guidelines Governing the Protection of Privacy and Transborder 
Flows of Personal Data, 20 I.L.M. 422 (1981), O.E.C.D. Doc. C (80) 58 (Final) (Oct. 1, 1980), 
at http:! ! www.oecd.orgl ldstilstilitlsecurlprodlPRrV-EN.HTM. 

45 U.S.C. 552a. 
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Although the Act was not and is not perfect, most experts agree that the FCRA 
was the first comprehensive privacy law enacted in the United States and that its 
general framework is soundly based on the Fair Information Practices. 

In 1989, in response to a series of complaints about credit reporting errors. Con- 
gress began a series of hearings that culminated in the 1996 Amendments to the 
FCRA. Three matters of extreme controversy — pitting consumer groups. State attor- 
neys general and, on all major issues joined by the Federal Trade Commission, 
against the financial industry — delayed final passage of the Amendments from 1992 
until 1996.® 

• First, industry insisted that the FCRA’s longstanding floor preemption provision 
(States can enact stronger laws) be reversed and that the Federal FCRA become 
a ceiling. The final 1996 Amendments preempted only some provisions of the 
FCRA, and then only for 8 years. 

• Second, industry fiercely resisted efforts to add a new provision to the Act impos- 
ing duties on creditors that furnish information to credit bureaus to ensure accu- 
racy and imposing liability when those duties were violated. The final provision 
imposed only limited duties. Liability for making errors was subjected only to 
agency enforcement, with consumers only having a private right of action to en- 
force violations of the Act’s reinvestigation provisions. 

• Third, industry insisted that a new exception to the definition of credit report be 
carved out, for the sharing of experience and transaction information among com- 
panies affiliated by common control. In addition, the new exception was included 
in the list of provisions subject to the temporary preemption of State action. 

The Affiliate Sharing Exception to the FCRA 
Although numerous hearings were held from 1989-1996 during consideration of 
the FCRA Amendments, we are unaware of any specific hearing on affiliate sharing, 
nor any record testimony of any significance, if any at all, provided by the industry 
about the subject. Yet, among State attorneys general, consumer groups, and the 
FTC, there was grave concern that Congress was acting precipitously to create a 
sweeping exception that could limit consumer access to the wide panoply of rights 
granted by the FCRA. 

The affiliate sharing exception allows detailed experience and transaction infor- 
mation to be shared and used for adverse actions without triggering the FCRA’s 
consumer protection rights,® in the circumstance where the information is shared 
among corporate affiliates. Experience and transaction information could include de- 
tails from credit card and checking account purchases, mortgage balances and pay- 
ment histories, bank account and brokerage balances and other deposit account 
usage information, relationships with co-signers, if any, etc. 

As the FTC, in an official position paper,^ stated on affiliate sharing: 

Because the subject of information sharing with affiliates has not been 
the subject of Congressional hearings, the factual basis for the provision is 
not necessarily available and the Commission cannot easily evaluate its 
pros and cons. The Commission believes, however, that caution is the best 
approach in considering whether to create what may become a significant 
exception to the consumer protections provided by the FCRA. It may be 
preferable to defer creation of any exceptions to the FCRA’s protections for 
affiliate sharing until Congress has an opportunity to study this issue and 
its implications more carefully. 

Congress did not debate affiliate sharing prior to 1996. Prior to enactment of the 
1999 Gramm-Leach-Bliley Act, however. Congress finally became acutely aware of 
the problems posed by unfettered information sharing. 

The Costs To Consumers of Under-Regulated Affdiate Sharing 
In 1999, while it was considering enactment of GLB, a sweeping deregulation of 
the financial services industry that would encourage the establishment of affiliate- 


®In the interim, a number of States, including Vermont (1992), California (1994), and Massa- 
chusetts (1995) acted more quickly to address credit reporting problems. 

®The 1996 Amendments do provide that consumers be provided an extremely limited notice 
if affiliate shared information is used adversely, but provision of the notice triggers no addi- 
tional rights. See FCRA Section 615(b)(2). Compare with notice under 615(a) (adverse action 
based on credit report), which triggers comprehensive rights and duties under Sections 609, 610, 
611. 

^The FTC took an official position on the proposed FCRA Amendments in 1994. U.S. PIRG 
has archived a (scanned) copy of the document, “H.R. 1015, Federal Trade Commission Analysis 
and Recommendations, 25 July 1994,” at http: 1 1 www.pirg.org I consumer /credit I ftcatmlysis 
hrl015.pdf. 
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based financial services supermarkets — with banks, brokerages, and insurance com- 
panies all under one roof — Congress became aware of the first two in a series of pri- 
vacy nightmares involving banks and their affiliates. 

• First, NationsBank (now Bank of America) had recently paid civil penalties total- 
ing $7 million to the Securities and Exchange Commission and other agencies, 
plus millions more in private class action settlements, over its sharing of confiden- 
tial bank accountholder information with an affiliated securities firm. “Registered 
representatives also received other NationsBank customer information, such as fi- 
nancial statements and account balances.”® In this case, conservative investors 
who held maturing certificates of deposits (CD’s) were switched into risky finan- 
cial derivative products. Some lost large parts of their life savings. 

• Second, Minnesota Attorney General Mike Hatch had recently sued U.S. Bank 
and its holding company, accusing them of having “sold their customers’ private, 
confidential information to MemberWorks, Inc., a telemarketing company, for $4 
million dollars plus commissions of 22 percent of net revenue on sales made by 
MemberWorks.’^® Memberworks and other nonafPiliated third party telemarketers 
sign credit card customers up for add-on “membership club” products and bill 
their credit cards as much as $89 or more if they do not cancel within 30 days. 
The catch? The consumer never gave the telemarketer her credit card number; 
her bank did, in a scheme known as preacquired account telemarketing. General 
Hatch has settled with both U.S. Bank and Memberworks. 

While industry continues to claim that these were isolated pre-GLB incidents, 
many of the Nation’s largest banks have since been involved in enforcement actions 
and private litigation over their similar sloppy information practices. Capital One,^® 
Chase Manhattan, Citibank,!^ First U.S.A.,i® GE Capital,'^'' MBNA America'^® are 
other banks or bank affiliates that have provided their customers’ personal and con- 
fidential information to fraudulent telemarketers. 

While some cynical consumers might expect tawdry marketing behavior from a 
credit card company, Minnesota Attorney General Mike Hatch also brought an ac- 
tion against a mortgage company, in this case a subsidiary of a national bank. In 
December 2000, the Minnesota Attorney General filed a complaint against Fleet 
Mortgage, an affiliate of FleetBoston, for substantially the same types of violations 
as U.S. Bank had engaged in. Incredibly, the firm was allowing telemarketers to 
add bills for buying club and roadside assistance plan memberships to consumer 
mortgage payments after making deceptive telemarketing calls based on confidential 
information derived from account relationships. That complaint was settled in 
June 2001.1'^ The State’s complaint explains the problem with sharing confidential 
account information with third party telemarketers. 

Other than a cash purchase, providing a signed instrument or a credit 
card account number is a readily recognizable means for a consumer to sig- 
nal assent to a telemarketing deal. Preacquired account telemarketing re- 
moves these short-hand methods for the consumer to control when he or 
she has agreed to a purchase. The telemarketer with a preacquired account 
turns this process on its head. Fleet not only provides its telemarketing 
partners with the ability to charge the Fleet customer’s mortgage account, 
but Fleet allows the telemarketing partner to decide whether the consumer 
actually consented. For many consumers, withholding their credit card ac- 
count number or signature from the telemarketer is their ultimate defense 


®See the SEC’s NationsBbank Consent Order http: ! Iwww.sec.gov ! litigation ! admin! 
337532.txt. 

®See the complaint filed by the State of Minnesota against U.S. Bank http:! jwww.ag.state. 
mn.us / consumer ! privacy / pr I pr%5Fusbank%5F06091999.html. 

Office of the Washington State Attorney General, “Settlement with Discount Buying Club 

Highlights Privacy Concerns,” Aug. 4, 2000, http: j i www.wa.gov ! ago! releases jrel brand 

direct 080400.html. 

^^Id. 

National Association of Attorneys Generals, “Multistate Actions: 27 States and Puerto Rico 
Settle with Citibank,” Feb. 27, 2002, http:! i www.naag.org jissues i 20020301-multicitibank.php; 

Settlement document available at http: j j www.oag.state.ny.us (press 12002 Ifeblfeb27b 02 

attach.pdf. 

13 Office of the New York Attorney General, “First USA to Halt Vendor’s Deceptive Solicita- 
tions,” Dec. 31, 2002, http: j j www.oag.state.ny.us i press i 2002 ( dec j dec31a_02.html. 

Supra, note 1. 
it>Id. 

i®See testimony of Minnesota Attorney Mike Hatch before this Committee, 19 September 2002 
at http:! ( banking.seTiate.gov i 02 09hrg j 091902 j index.htm. 

Minnesota v. Fleet Mortgage Corp., 158 F. Supp. 2d 962 (D. Minn. 2001), available at http:! 
i www.ag.state.mn.us i consumer ! PR i Fleet Opinion 61901.html. 



298 


against unwanted charges from telemarketing calls. Fleet’s sales practices 
remove this defense. 

Another bank, Charter Pacific, was caught selling its database containing 3.6 mil- 
lion valid credit card account numbers to a convicted felon who then fraudulently 
billed the accounts for access to Internet pornography sites that victims had never 
visited. In fact, approximately 45 percent of the victims did not even own a 
computer. Charter Pacific did not develop the database from its own customers’ in- 
formation. Instead, it compiled the information from credit cardholders who had 
purchased goods and services from merchants that had accounts at Charter Pacific. 
The information included the date of sale, account number, and dollar amount of 
every credit card transaction processed by the bank’s merchant customers. The un- 
restricted sharing of this information resulted in over $44 million of unauthorized 
charges. 

When data collectors do not adhere to Fair Information Practices, consumers face 
numerous privacy risks. A summary of significant privacy costs includes the 
following: 

• Consumers pay a much higher price than dinner interruptions from tele- 
marketers. Many unsuspecting consumers may still be paying $89/year or more 
for essentially worthless membership club products they did not want and did not 
order. Although the Federal Trade Commission has enacted amendments to the 
Telemarketing Sales Rule^® (TSR) in an attempt to regulate the tawdry bank 
practices described above, additional amendments may be necessary to ensure 
that banks and their affiliates and subsidiaries comply fully with the amend- 
ments, since they may run to the OCC for protection from the FTC otherwise. 

• Easy access to confidential consumer identifying information leads to identity 
theft. Identity theft may affect 500,000-700,000 consumers each year. Identity 
theft victims in a recent PIRG/Privacy Rights Clearinghouse survey faced aver- 
age out-of-pocket costs of $808 and average lost time of 175 hours over a period 
of 1-4 years clearing an average $17,000 of fraudulent credit off their credit re- 
ports. It is difficult to measure the costs of higher credit these consumers pay, let 
alone attempt to quantify the emotional trauma caused by the stigma of having 
their good names ruined by a thief who was aided and abetted by their bank and 
credit bureau’s sloppy information practices. The Committee need only review last 
week’s compelling testimony of Captain John Harrison (Ret.). In his oral state- 
ment, in particular, Harrison described how he had gone from a high-achieving 
military officer to a failed salesman who recently lost his job due to, in his view, 
his loss of confidence caused by his inability to cope with the frustration and emo- 
tional distress of being a victim of identity theft and his subsequent inability to 
clear his name of 61 fraudulent credit accounts. 

• The Easy access to Social Security numbers by Internet information brokers and 
others also leads to stalking. 

• The failure to safeguard information and maintain its accuracy leads to mistakes 
in credit reports and consequently consumers pay higher costs for credit or are 
even denied opportunities. 

• Researchers at Michigan State University recently studied over 1,000 identity 
theft cases and found that victims in 50 percent of the cases specifically reported 
that the theft was committed by an employee of a company compiling personal 
information on individuals.®^ Many identity fraud cases stem from the perpetra- 
tor’s purchase of consumers’ personal information from commercial data brokers. 
Financial institutions information sharing practices contribute to the risk of iden- 
tity theft by greatly expanding the opportunity for thieves to obtain access to sen- 
sitive personal information. 


i®28 December 2000, Complaint of State of Minnesota vs. Fleet Mortgage, see http:! Iwww.ag. 
state. mn.us / consumer I news / pr / Comp Fleet 122800.html. 

Federal Trade Commission, “FTC Wins $37.5 Million Judgment from X-Rate Website Oper- 
ator; Bank Sold Defendants Access to Active MasterCard, Visa Card Numbers,” Sept. 7, 2000, 
http:! / WWW. ftc.gov / opa / 2000 / 09 1 netfill.htm. 

®®The amendments took effect 31 March 2003. http: 1 1 www.ftc.gov I opa 12003 j 01 j tsrfrn 
final.htm. 

^^See “Nowhere To Turn: A Survey of Identity Theft Victims, May 2000, CALPIRG and Pri- 
vacy Rights Clearinghouse, http: 1 1 calpirg.org / CA.asp?id2=3683&id3=CA&. 

Senate Banking Committee Hearing On Identity Theft, 19 June 2003. See Captain Har- 
rison’s testimony at http:l j hanking.senate.gov ! 03 OShrg / 06 1903 lharrison.pdf. 

Personal communication from author to Chris Hoofnagle of EPIC. Study forthcoming; re- 
sults provided in e-mail from Judith M. Collins, Ph.D., Associate Professor, Leadership and 
Management Program in Security School of Criminal Justice, Michigan State University to 
EPIC (Apr. 22, 2003, 18:13:35 EST) (on file with EPIC). 
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• The unlimited collection and sharing of personal data poses profiling threats. Pro- 
files can be used to determine the amount one pays for financial services and 
products obtained from within the “financial supermarket” structure. As just one 
example, information about health condition or lifestyle can be used to determine 
interest rates for a credit card or mortgage. Even with a history of spotless credit, 
an individual, profiled on undisclosed factors, can end up paying too much for a 
financial service or product. Because there are no limits on the sharing of per- 
sonal data among corporate affiliates, a customer profile can be developed by a 
financial affiliate of the company and sold or shared with an affiliate that does 
not fall within the broad definition of “financial institution.” A bank, for instance, 
that has an affiliation with a travel company could share a customer profile re- 
sulting in the bank’s customer receiving unwanted telephone calls and unsolicited 
direct mail for offers of memberships in travel clubs or the like that the individual 
never wanted or requested. A negative credit decision based on this profile would 
not trigger the vast consumer protection rights that would be triggered by use of 
a strictly regulated credit report.^’' 

• Further, the lack of any regulation of experience and transaction information may 
pose risks for the privacy of health data. Confidential medical records held by any 
health insurer or hospital are strictly regulated by the Health Insurance Port- 
ability and Accountability Act (HIPAA)’s medical privacy rules. If that information 
is obtained by any GLB entity, it could be freely shared outside of HIPAA.^® 

In response to the public uproar over the NationsBank and U.S. Bank cases. Con- 
gress included a privacy title. Title V, in GLB.^® 

While the FCRA Is Based on Comprehensive Protections, 

The Gramm-Leach-Bliley Financial Services Modernization Act’s 
No Opt Regime Conversely Fails to Adequately Regulate Either Affiliate 
or Third Party Information Sharing 

The GLB’s No Opt Regime 

Much of the debate over affiliate sharing and financial privacy has not been over 
whether financial institutions protect information under the Fair Information Prac- 
tices. Rather, the debate has been over whether banks and other institutions should 
provide consumers with an express consent right (affirmatively say yes, or opt in, 
before sharing) or whether information sharing should be allowed automatically un- 
less the consumer says no (OK to share as long as consumer does not opt out). In- 
dustry documents and materials assert that the debate is over opt out or opt in, 
falsely implying that they are for opt out, but that opt in goes too far and would 
cost too much. 

Actually, the vast majority of the financial services industry has yet to agree that 
even an opt out is acceptable — most companies are actually for no opt. 

Many observers are unaware that the primary protection Congress established in 
Gramm-Leach-Bliley is provided only by notice (no opt), not by opt out. The Fair 
Credit Reporting Act is based broadly on the Fair Information Practices, but GLB 
is, at best, based on FIP’s-Lite. Notice is not enough. When comprehensive data- 
bases of information are held and used by companies, consumers need all of the 
rights provided by the Fair Information Practices. GLB does not regulate in any way 
affiliate sharing of experience and transaction. It does not close the loophole estab- 
lished in the FCRA. 

Under GLB, sharing of experience and transaction information with either affili- 
ates or with any third party providing joint marketing services is unregulated under 
a no opt regime. The rationale for treating marketing partners as affiliates was os- 
tensibly to create a level playing field for smaller institutions that might not have 
in-house affiliates selling every possible product larger firms might sell. Of course, 
large firms use joint marketing partners, too. 

The limited consumer right to opt out Congress established only applies in the 
circumstance where the bank shares experience and transaction information with 
other third parties selling nonfinancial services, primarily telemarketers. Even Con- 


24 For additional discussion of the profiling issue, and related privacy threats posed by infor- 
mation sharing, see 1 May 2002 comments of EPIC, U.S. PIRG, Consumers Union, and Privacy 
Rights Clearinghouse on the GLBA Information Sharing Study (Federal Register: February 15, 
2002 (Volume 67, Number 32)) available at http: 1 1 www.epic.orgl privacy t financial! 
gib comments.pdf. 

2^ See testimony on medical privacy of Joy Pritts, Georgetown University and Marc Rotenberg, 
EPIC, House Financial Institutions Subcommittee, 7 June 2003 at http: ! ! financialservices. 
house.gov / hearings. asp?formmocle=detail&hearing=231. 

26 15 U.S.C. §§ 6801-09. 
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gressional Research Service reports have misunderstood the modest effect of the 
limited opt out provisions of GLB.^^ 

GLB should have closed the affiliate sharing exception in the FCRA. It did not. 
The failure of the GLB to regulate or require any form of consumer consent for the 
vast majority of information sharing transactions affected is one example of how 
GLB — unlike the broader FCRA as it applies to credit reports — fails to meet the 
Fair Information Practices. GLB fails to adequately protect consumer privacy. 

Notice is Not Enough 

The result of this defective scheme is that most information-sharing is only regu- 
lated or “protected” by notice. Sharing of confidential consumer information with 
either affiliates or joint marketing partners continues regardless of a consumer’s pri- 
vacy preference. Although we have no way of knowing how many joint marketing 
partners a company may have, we do know how many affiliates some of the largest 
financial services holding companies and bank holding companies have. For their re- 
cent joint comments to the Treasury Department on GLB, State Attorneys General 
accessed the Federal Financial Institutions Examination Council and Federal Re- 
serve websites and counted affiliates for Citibank (2,761), Key Bank (871) and Bank 
of America (1,476).^® 

In 2001, a coalition of consumer and privacy groups filed a petition's with the 
agencies responsible for enforcing the GLB Privacy Rule. On an encouraging note, 
many of the petitioners have recently been informally contacted to watch for agency 
actions in response to that petition calling for better privacy notices. Some industry 
members are even supporting improvements to the privacy notices. Of course, im- 
proving the notices does not change the flawed GLB approach to the sharing of in- 
formation among affiliates and third parties. 

A Comparison of the Regulated and Unregulated Information Sharing of 
FCRA and GLB 

Categories of information regulated by the FCRA and GLB are treated in several 
different ways. The FCRA strictly regulates consumer credit reports. Credit bureaus 
sell certain other products, known as credit headers, under an unregulated regime, 
although recent court decisions have narrowed the credit header exception. Credit 
bureaus also sell under-regulated, prescreened lists of consumers derived from cred- 
it reports, for credit and insurance related purposes. Prescreened opt out notices are 
hard to find and harder to read; the opt out mechanism is overly complex and, for 
a permanent opt out, a consumer must make a call, receive a notice in the mail, 
sign it, stamp it, and return it.®° 

Information obtained by corporate affiliates, however, is known as either “experi- 
ence and transaction” information or “other” information and regulated by exception 
to the FCRA. Title V of GLB provides that once companies have provided customers 
with notice of their information sharing policies, they can share experience and 
transaction under the extremely permissive GLB regime, with consumer protection 
provided primarily by notice only (no opt). 


2'^ See for example, “Financial Privacy — The Economics of Opt In vs Opt Out. (Updated 16 Apr 
2003) by CRS’s Loretta Nott. It repeats a mischaracterization of GLB that I believe has been 
made in other CRS reports. The third sentence states: “A consumer’s financial information may 
be shared among the (affiliates of the same corporate) group as long as the person has been 
notified and has the opportunity to decline, or ‘opt out.’” The paragraph goes on to wrongly say 
that the Johnson S. 660/Tiberi H.R. 1766 proposals are intended, among other things to, “main- 
tain the opt out policy for affiliate information sharing.” 

See 1 May 2002 Attorneys General Comments http: I lwww.ots.treas.gov I docs Ir.cfm 
?95421. pdf or http:! / www.epic.org ! privacy ! fitiancial ! ag_glb comments.html on the GLBA In- 

formation Sharing Study (Federal Register: February 15, 2002 (Volume 67, Number 32)). 

2®The petition is available at http:! / www.privacyrightsnow.com / glbpetition.pdf. See the 
website http:j / www.privacyrightsnow.com for additional information about the coalition. 

3® See PIRG’s testimony before the House Financial Institutions Subcommittee, 4 June 2003 
for a detailed analysis, http:! I financialservices.house.gov I media / pdf / 060403em.pdf. 

®iThe DC Circuit is 2001 decision is F.3d 809 (2001). http: j I laws.findlaw.com ! dc I 

001141a.html. The Supreme Court also denied cert. (536 U.S. (2002) 01—1080, 10 June 

2002) in TransUnion I vs. FTC, which ended 10 years of litigation over TransUnion’s illegal use 
of credit reports for target marketing. 

^^TransUnion II vs. FTC, See http: I Ilaws.findlaw.comldcl015202a.html. This important ap- 
pellate decision upheld the constitutionality of the GLB privacy regulations and restricted the 
sale of nonpublic personal information, including Social Security numbers, by credit bureaus 
outside of the strict FCRA regime. 

®®The prescreening opt out does not stop the flow of credit card solicitations, it only slows 
it down. Now, many retailers, airlines, organizations, and others routinely send credit card so- 
licitations to their customers. Yet, these offers are based on affiliate sharing — under the 
Gramm-Leach-Bliley Act, not the FCRA. No credit report was used for prescreening, so no opt 
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Information Sharing Under The FCRA and The GLB 


Type of Information 

Shared or Sold By 

Protection Scheme 

Consumer credit reports and 
investigative consumer re- 
ports 

Credit Bureaus 

FCRA: Comprehensive regu- 
lation under FIP’s. 

Credit headers (Demographic, 
noncredit related, informa- 
tion derived from credit re- 
ports) 

Credit bureaus 

FCRA: Previously sold under 
exception to FCRA, but 
under recent decisions by 
the DC Circuit, U.S. Court 
of Appeals, dates of birth^i 
and Social Security num- 
bers ^2 can no longer be 
sold as part of credit head- 
ers. 

Prescreened lists of con- 
sumers with certain charac- 
teristics^^ 

Credit bureaus 

FCRA: Moderately regulated, 
with weak right for con- 
sumers to opt out. Lists 
cannot be used for general 
target marketing, only sold 
for marketing credit or in- 
surance products. 

“Experience and Transaction” 
Information (credit card 
and checking account pur- 
chases, mortgage balances, 
bank account and brokerage 
balances, and other deposit 
account usage information, 
relationships with co-sign- 
ers, etc.) 

Banks, brokerages, insurance 
companies, and other fi- 
nancial institutions 

FCRA provides that this in- 
formation is not regulated 
as a credit report. GLB: 
Can be shared with any af- 
filiate or any third party in 
a joint marketing relation- 
ship with bank to sell fi- 
nancial products regardless 
of customer’s privacy pref- 
erence (no opt). Customer 
has right to opt out only if 
information will be shared 
with or sold to other third 
parties, primarily tele- 
marketers. 

“Other” information obtained 
from a consumer’s applica- 
tion, a consumer’s credit re- 
port or a consumer’s ref- 
erences 

Banks, brokerages, insurance 
companies, and other fi- 
nancial institutions 

FCRA: Affiliates can share 
this information with affili- 
ated companies provided 
consumer is given a notice 
and a right to opt out. 

GLB exceptions to opt out 
rights 

Banks, brokerages, insurance 
companies, and other fi- 
nancial institutions 

Under numerous exceptions, 
opt outs do not apply to ex- 
perience and transaction 
information shared with 
any affiliate or third party 
for completion of con- 
sumer’s transaction, fraud 
control. Government pur- 
poses, secondary market 
underwriting, etc. 


How the Gramm-Leach-Bliley Act Falls Short of the Fair Information Practices 
First, GLB fails to require any form of consent (either opt in or opt out) for most 
forms of information sharing for secondary purposes, including experience and 


out is provided on the mailings. Under Gramm-Leach-Bliley, affiliate sharing of “experience and 
transaction” information is subject to a no opt rule. The FCRA opt out does not apply, nor does 
the limited GLB opt out. Congress should create a “no credit card offers” list and apply the 1- 
call opt out to all credit card solicitations not only prescreened solicitations. 
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transaction information shared between and among either the affiliates or certain 
affiliated third parties with “joint marketing agreements.” These outside firms are 
treated as if they were affiliates, under the no opt regime. 

Second, while institutions point out consumers generally have access to and dis- 
pute rights over their financial account statements, they have no knowledge of, let 
alone rights to review or dispute, the development of detailed profiles on them cre- 
ated by financial institutions. California is considering a PIRG-backed proposal to 
address the problem that consumers have neither knowledge of nor a right to in- 
spect marketing profiles.®^ 

Third, while GLB does require disclosure of information practices, numerous re- 
views of these privacy policies, by outside experts,^® CALPIRG,®® and others has 
documented that the policies are unreadable and incomprehensible. None fully ex- 
plain all uses of information, including the development of consumer profiles for 
marketing purposes. None list all the affiliates, or even all the types, that they 
might share information with. None describe the specific products, most of which 
are of minimal or even negative value to consumers, that third party telemarketers 
might offer for sale to consumers who fail to opt out. Yet all the privacy policies 
make a point of describing how consumers who elect to opt out will give up “bene- 
ficial” opportunities. 

Fourth, GLB does not give consumers a private right of action to enforce the law 
as the FCRA generally does. 

GLB’s Preservation of States’ Rights: The Sarbanes Amendment 

Congress recognized that GLB did not adequately protect privacy and that Title 
V was only a modest first step. Indeed, Chairman Shelby pointed this out in his 
floor remarks in opposition to the bill’s enactment in 1999. 

We are about to pass this afternoon a financial modernization bill that 
represents industry interests in a big way. However, we have forgotten the 
interests of the most crucial market participant of all in America — the con- 
sumer, the American citizen. Under this bill, the consumer has little, if any, 
ability to protect the transfer of his or her personal nonpublic financial in- 
formation. ... I can assure Members these large financial conglomerates 
will have more information on citizens than the IRS, but we have done vir- 
tually nothing to protect the sharing of such nonpublic personal financial 
information for the American people. . . . First, the opt out requirement 
does not apply to affiliate sharing. . . . Second, the bill includes an excep- 
tion to the porous opt out provision that allows two or more financial insti- 
tutions to share their customers’ nonpublic personal information with tele- 
marketers to market financial products or services offered under a so-called 
joint agreement. ... I believe these privacy provisions are a sham. I have 
said it before.®^ 

In recognition of the concerns of a bi-partisan group of Members, led by Senators 
Shelby (R-AL) and Sarbanes (D-MD) and Representatives Barton (R-TX) and Mar- 
key (D-MA), the Congress took the exceedingly rare step of affirmatively and spe- 
cifically granting the States the right to enact stronger financial privacy laws. In 
conference committee, the Congress inserted an amendment offered by Senator Sar- 
banes granting States the right to enact stronger financial privacy laws: 

Sec. 6807. Relation to State laws 

(a) In general 

This subchapter and the amendments made by this subchapter shall not be 
construed as superseding, altering, or affecting any statute, regulation, 
order, or interpretation in effect in any State, except to the extent that such 


Proposed California legislation, SB 27, offered by State Senator Liz Figueroa, would require 
a business that discloses a consumer’s personal information to a third party for direct marketing 
purposes to provide to a customer, upon request, a written description of the sources and recipi- 
ents of that information and copies of the information disclosed. See http: j ! www.leginfo.ca.gov ! 
puh thill ! sentsh 0001-0050 / sb 27 cfa 20030507 132723 sen comm.html. 

Mark Hochhauser, readability consultant to the Privacy Rights Clearinghouse, analyzed 
dozens of the initial notices: “Readability analyses of 60 financial privacy notices found that they 
are written at a 3rd--4th year college reading level, instead of the junior high school level that 
is recommended for materials written for the general public. See “Lost in the Fine Print: Read- 
ability of Financial Privacy Notices” by Mark Hochhauser at http:! Iwww.privacyrights.org I art 
GLB -Reading, htm. 

See the CALPIRG report Privacy Denied: A Survey Of Bank Privacy Policies, 15 Aug 2002, 
http:! j calpirg.org t CA.asp?id2=7606&id3=CA&. 

145 CR S13895 Floor remarks of Senator Richard Shelby (R-AL), 4 Nov 1999, during con- 
sideration of S. 900, which became GLB. 
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statute, regulation, order, or interpretation is inconsistent with the provi- 
sions of this subchapter, and then only to the extent of the inconsistency. 

(b) Greater protection under State law 

For purposes of this section, a State statute, regulation, order, or interpre- 
tation is not inconsistent with the provisions of this subchapter if the pro- 
tection such statute, regulation, order, or interpretation affords any person 
is greater than the protection provided under this subchapter and the 
amendments made by this subchapter, as determined by the Federal Trade 
Commission, after consultation with the agency or authority with jurisdic- 
tion under Section 6805(a) of this Title of either the person that initiated 
the complaint or that is the subject of the complaint, on its own motion or 
upon the petition of any interested party. (Pub. L. 106-102, Title V, Sec. 

507, Nov. 12, 1999, 113 Stat. 1442.) 

The GLB Conference Report illustrates the final statement of the terms agreed 
to by both Houses, which confirms what GLB states explicitly: The States are free 
to adopt laws regarding the privacy of consumer financial information provided to 
financial institutions. On the floor. Senator Sarbanes emphasized protection of the 
States’ authority to legislate in the area of consumer privacy: 

[W]e were able to include in the conference report an amendment that 
I proposed which ensures that the Federal Government will not preempt 
stronger State financial privacy laws that exist now or may be enacted in 
the future. As a result. States will be free to enact stronger privacy safe- 
guards if they deem it appropriate. 

Likewise, Senator Grams®® said the savings clause of GLB, “preserves all existing 
and all future State privacy protections above and beyond tbe national floor estab- 
lished in this bill.” House Members similarly interpreted the amended bill. As Rep- 
resentative John LaFalce'^® said, “[T]he conference report totally safeguards strong- 
er State consumer protection laws in the privacy area.” 

Industry’s Claim That The FCRA’s Preemption Provision Trumps 
GLB’s States’ Rights Provision Is False, But Its Propaganda Campaign 
Has Had a Chilling Effect on State Action To Enact Stronger 
Financial Privacy Laws 

The FCRA regulates credit reports. As discussed above, a narrow exception states 
that when companies share information among corporate affiliates, the sharing does 
not make the sharing entity a credit bureau, with a credit bureau’s concomitant re- 
sponsibilities and duties. Although that exception is troubling, since it means that 
companies are able to make credit decisions on the basis of unregulated internal 
databases, nothing in the legislative history suggests that Congress intended more 
than that when it exempted affiliate sharing from the FCRA in 1996. 

But while the substantial legislative history and the plain language of Section 
6807 of the GLB grants States greater rights to enact stronger privacy laws, indus- 
try has alleged that a different provision of GLB, Section 6806, renders the Sar- 
banes Amendment meaningless. 

The Sarbanes Amendment and the FCRA Savings Clause 

Section 6806 is the so-called FCRA savings clause and is intended to preserve the 
greater protections of the FCRA strictly regulating credit reports from being weak- 
ened by GLB’s lesser protections. Industry claims that the FCRA savings clause cre- 
ates a safe harbor preventing the Sarbanes Amendment from applying to affiliate 
sharing, by allowing the preemptive affiliate sharing exception of the FCRA to 
trump GLB’s Sarbanes Amendment. 

Yet, as former FTC Chairman Pitofsky testified before Congress on financial serv- 
ices modernization, in a 1999 hearing on H.R. 10, the House bill which became GLB: 

Finally, the bill should make it clear that its privacy provisions do not 
limit the FCRA’s protections to the extent they apply to financial institution 
files. ... If construed to supersede the FCRA, the H.R. 10 privacy provi- 
sions would be a major retreat in privacy protections for consumers. Credit 
reports could be distributed to firms that had no permissible purpose to see 
them if the consumer did not take the affirmative step of stopping that 
practice. The Commission believes it essential to eliminate the potential for 
such an interpretation by adding a savings clause indicating that, notwith- 


145 Cong. Rec. S13789 (1999) Statement of Senator Sarbanes on final passage of GLB. 
3® 145 Cong. Rec. S13889 (1999) Statement of Senator Grams. 

^*’145 Cong. Rec. E2310 (1999) Statement of Representative LaFalce. 
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standing any provisions of H.R. 10, the full protections of the FCRA con- 
tinue to apply where applicable.''^ [Emphasis added] 

Industry argues that the FCRA savings clause inserted following the FTC Chair- 
man’s request instead acts to limit consumer protection. Industry argues that some- 
how the purpose of the clause is to allow the FCRA’s one weaker exception — not its 
myriad greater protections — to prevail. War is peace. Up is down. 

State and Local Action under the Sarbanes Amendment 

Industry’s threats that the Sarbanes Amendment is meaningless have had a 
chilling effect on State efforts to enact stronger financial privacy laws governing 
affiliate sharing. Although numerous States have considered financial privacy legis- 
lation since 1999, only California has come close to enactment of legislation. In Cali- 
fornia, a compromise version of SB 1, proposed by State Senator Jackie Speier, has 
passed the State Senate but is currently mired in the Assembly Banking Committee 
due to industry opposition. The bill would greatly strengthen consumer rights in in- 
formation sharing. Anticipating that the bill will not pass, consumer groups includ- 
ing CALPIRG and Consumers Union have already collected over 200,000 signatures 
toward a proposed ballot initiative for March 2004. The ballot initiative is even 
stronger than SB 1. 

Although it remains the consumer group view that the FCRA savings clause of 
GLB’s effect on the Sarbanes Amendment should be construed narrowly, it should 
be noted that the groups planned the ballot referendum for 2004, after the sched- 
uled sunset of FCRA preemption, to clear one additional procedural hurdle: Pre- 
dicted bank litigation. 

Indeed, tired of waiting for the State or Congress to act, several California cities 
and counties led by San Mateo and Daly City, have enacted local financial privacy 
ordinances modeled after SB 1. The ordinances will take effect on 1 September 2003, 
but first they must survive court challenges by Bank of America and Wells Fargo, 
joined by the Nation’s chief national bank regulator, the Office of the Comptroller 
of the Currency.''^ 


Comparison of Major Consent Features of Financial Privacy Laws and Proposals 


Sharing With Affiliates 

Sharing With Third 
Parties With Joint 
Marketing Agreements 

Sharing With 
Unaffiliated Third 
Parties Selling Non- 
Financial Products 
(Telemarketers) 

Gramm-Leach-BIMey 

No'Opt (Notice only) 


SB 1 (Speier) and local 
ordinances In 

California 

Opt-out, except certain 
same-line-of-business 
affiliates would still be 

no-opt. 

Opt-out 

Opt-ln 

March 2004 Ballot 
Proposal in California 

Opt-ln: All Transactions 

Note: All laws and proposed bills include exceptions for completing consumer’s transaction, fraud control, 
underwriting, government puiposes, etc. 


If the cities lose in court, despite the clear legislative history in their favor, par- 
ticularly under a National Bank Act preemption argument, it may be appropriate 
for the Congress to consider a narrow clarifying amendment to GLB that makes it 
clear that the Sarbanes Amendment is the paramount Federal rule on financial pri- 
vacy, all other laws notwithstanding. 

Industry Has Misrepresented the Goal and the Effect of State Financial 
Privacy Laws 

Throughout the debate over financial privacy and the FCRA preemption, industry 
has engaged in a two-part strategy to confuse the public and decisionmakers. 

First, Industry Claims To Be For Opt Out, When It Is In Favor Of No Opt 
As discussed above in the section on GLB, industry muddles the issue of no opt 
versus opt out. For example, a white paper prepared for the industry that is rou- 
tinely cited by industry witnesses before Congress states the following: 

Congress struck a critical balance in the 1996 FCRA Amendments be- 
tween consumers’ interest in reaping the benefits of accessible credit files 


Testimony of FTC Chairman Robert Pitofsky before the House Financial Institutions Sub- 
committee on HR 10, 21 July 1999, at http:/ 1 financialservices.house.gov I banking /72199pif him. 

42 For more information about OCC’s abusive preemption positions generally, see http:/ / 
www.pirg.org / occwatch. 
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and their interest in privacy. That balance is reflected in the combination 
of preemption and opt out provisions for prescreening and affiliate-sharing. 
Efforts to fundamentally alter that balance by not reenacting preemption 
and/or by conditioning prescreening and afflliate-sharing on opt in threaten 
to impose considerable costs on consumers, business, and the economy, 
while not increasing privacy protection.''^ 

The paper is wrong on the affiliate sharing opt out, unless it is cleverly hedging 
behind the limited “other” information opt out.'''' It fails to accurately describe the 
actual no opt regime in place for affiliate sharing of experience and transaction in- 
formation. For this and numerous other reasons, one expert observer, an inde- 
pendent privacy consultant, called this paper “shockingly incompetent.”''® 

Industry witnesses refer to a number of other white papers and pseudo-academic 
documents''® purporting to prove that either eliminating State preemption or pro- 
viding greater financial privacy protections will cost the economy “billions of dol- 
lars.” In our view, these papers are based on specious assumptions. 

• None of the papers measure the costs of not protecting privacy, including the costs 
of identity theft. 

• None of the papers measure the cost to society of inaccurate credit reports caused 
by mistakes due to lack of enforcement of the Federal FCRA. 

• None of the papers separate the impact, if any, of the 1996 preemption provisions 
from other dependent variables or attempts to evaluate the effect of other factors 
on the credit economy. 

None of the industry studies attempt to quantify the costs of not protecting pri- 
vacy. One contrary study finds, “In fact, the costs incurred by both business and in- 
dividuals due to incomplete or insufficient privacy protections reach tens of billions 
of dollars every year.”''^ 

None of the industry studies measures the costs of inaccurate credit reports. Ac- 
cording to just one key finding of a major recent study of 500,000 credit files: 

Misclassification into the subprime mortgage market can require a bor- 
rower to overpay by tens of thousands of dollars in interest payments on 
a typical mortgage. For example, over the life of a 30-year, $150,000 mort- 
gage, a borrower who is incorrectly placed into a 9.84 percent subprime 
loan would pay $317,516.53 in interest, compared to $193,450.30 in interest 
payments if that borrower obtained a 6.56 percent prime loan — a difference 
of $124,066.23 in interest payments. 

That study,''® by the Consumer Federation of America and National Credit Re- 
porting Association, found that at least 8 million consumers are at risk of being 
misclassifled into subprime credit due to sloppy information handling practices by 
credit reporting agencies. 

None of the industry studies measures the costs of a post-GLB credit economy 
where adverse decisions are made without consumers gaining the right to know 
about, look at, dispute, or correct their file. 

Industry Falsely Claims That Financial Privacy Laws Will Stop All Information 
Sharing, not Simply Sharing for Secondary Purposes 

Perhaps even more importantly, industry’s white papers and testimony and press 
releases have made a wide variety of false and even wild claims about the goal and 
effect of financial privacy laws: 


''^Financial Privacy, Consumer Prosperity, and The Public Good: Maintaining The Balance. 
Fred Cate, Robert E. Litan, Michael Staten, Peter Wallison. Mar 2003. See http: I huwiv.aei. 
brookings.org I publications I abstract.php?pid=313. 

''''See FCRA, Section 604 (d)(2)(A)(iii) concerning information obtained from “other” sources, 
such as a consumer’s credit report or application or references. 

''® “No Fair Fight Over FCRA Provision,” by Robert Gellman, DM News, 6 May 2003. 

''® Harvard Law School Professor Elizabeth Warren, co-author of several major peer-reviewed 
studies of the impact of bankruptcy on consumers, has written an extensive article criticizing 
the use of “proprietary” research (data not available or peer-reviewed, paid for by industry asso- 
ciations that hire academic “research” centers) to make public policy. Wisconsin Law Review 
Vol. 2002, No. 1, “The Market For Data: The Changing Role of Social Sciences in Shaping The 
Law,” Public Law Research Paper No. 038 See http:ljpapers.ssrn.comlsol3lpapers.cfm 
?abstract id=332162. 

47 “Privacy, Consumers, and Costs: How The Lack of Privacy Costs Consumers and Why Busi- 
ness Studies of Privacy Costs are Biased and Incomplete,” by Robert Gellman, March 2002, See 
http:! / www.epic.org I reports I dmfprivacy.html. 

''® “Credit Score Accuracy and Implications for Consumers,” December 17, 2002, Consumer 
Federation of America and the National Credit Reporting Association http:! I www. consumer 
fed.org 1 121702CFA NCRA Credit Score Report_Final.pdf. 
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• Industry alleges that stronger financial privacy laws will prevent firms from using 
one telephone call center for all of a consumer’s accounts. 

• Industry claims that financial privacy laws “will hinder their efforts to spot ter- 
rorists.”"*® 

• Industry claims that information sharing is critical to stopping fraud and identity 
theft. 

Actually, the goal of consumer financial privacy laws is not to prevent these uses. 
SB 1 (California) would simply limit information sharing for secondary purposes 
without consent. The goal of SB 27 (California) is to give consumers access rights 
in GLB that modestly approach those of the FCRA. 

Here is the antifraud, anti-identity theft, exception to the opt out in existing Fed- 
eral law: 

GLB Section 6802(e)(3)(A) to protect the confidentiality or security of the 
financial institution’s records pertaining to the consumer, the service or 
product, or the transaction therein; (B) to protect against or prevent actual 
or potential fraud, unauthorized transactions, claims, or other liability; (C) 
for required institutional risk control, or for resolving customer disputes or 
inquiries; (D) to persons holding a legal or beneficial interest relating to the 
consumer; or (E) to persons acting in a fiduciary or representative capacity 
on behalf of the consumer; 

Similar provisions exist for completing a consumer’s transaction, underwriting, to 
comply with Government requirements, or to protect the “public safety.” 

In addition, each of the proposed State and local laws and ballot initiatives, to 
our knowledge, includes similar exceptions. 

It is worse than disingenuous to claim that financial privacy laws, intended to 
give consumers control over the use of their confidential information for secondary 
marketing and profiling purposes, will completely close the spigot of information 
sharing for laudable purposes. 

Does Information Sharing Prevent Identity Theft? No 

Industry has claimed that information sharing is critical to identity theft preven- 
tion. From 1989 through 1996, while Congress considered the stren^hening of the 
FCRA, identity theft was not a significant issue in the debate. While it turns out 
that the problem was growing, the industry had been keeping it quiet and absorbing 
the costs of fraud without providing Congress or the FTC with significant informa- 
tion. In 1996, the State PIRG’s released the first national report on the problem, 
“The Consumer X-Files,” documenting the cases of several identity theft victims and 
attempting to quantify the problem. 

In 1997, the State PIRG’s released a follow-up, “Return To The Consumer 
X-Files.” In 2000, the State PIRG’s and Privacy Rights Clearinghouse released a 
detailed survey of identity theft victims, “Nowhere To Turn.”®* In 2003, CALPIRG 
released the first analysis of police officer views on identity theft, “Policing Pri- 
vacy.”®® It found that police share consumer groups’ views that creditor practices 
must be reined in to stop identity theft. 

In 1998, Congress took its one step to stop identity theft, criminalizing it without 
reining in the creditor and credit bureau practices that aid and abet the thieves. 

The FTC has recently reported that identity theft was the leading complaint to 
the Agency for the years 2000, 2001, and 2002. The number of cases doubled in 
2002, according to the FTC. Based on fibres reported to the GAO by the credit bu- 
reaus themselves, identity theft may strike as many as 500,000-700,000 consumers 
annually. Criminalization has not worked. Do industry’s unbelievable allegations 
that identity theft is being slowed by information sharing mean the problem would 
be even worse without information sharing? 

Misuse, overuse, and easy access to Social Security numbers is what drives the 
identity theft epidemic. Fundamentally, this nation needs to wean the private sector 
of its over-reliance on Social Security numbers (SSN) as unique identifiers and data- 
base keys. Creditors issue credit based on a match between an applicant’s Social Se- 


“Privacy Laws Under Attack,” Associated Press, 19 Feb 2002. The article quotes executives 
of two powerful industry associations opposing State privacy laws on terrorism grounds: The Fi- 
nancial Services Roundtable (“We would have trouble communicating with law enforcement 
. . .”) and the Financial Services Coordinating Council (“I do not think that explicitly a legis- 
lator would try to hurt the exchange of information that would allow law enforcement to do 
what they need to do . . .”) 

®®See http:! / www.pirg.org I reports I consumer I xfiles I index.htm. 

®*See http: ! I calpirg.org I CA.asp?id2=3683&id3=CA&. 

®®See http:! / www.pirg.org / alerts ! route.aspHd2=9791. 
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curity number and a credit bureau Social Security number, with no additional 
verification in many cases that the applicant is actually the consumer whose credit 
bureau file is accessed. Getting Social Security numbers out of circulation and im- 
proving sloppy credit granting practices, not unfettered information sharing, are the 
real solutions to the identity theft menace. 

Changing Industry Practices Limiting Information Sharing, not The Threat 
of State Action, Are the Real Threat To the Economy 

Failure To Report Completely To Game Credit Score Results 

This spring, the Federal Reserve Board of Governors released a major study®® of 
credit reports. Among its key findings, based on a review of 248,000 credit reports 
held by one unnamed repository, was the following: Fully 70 percent of consumers 
had at least one trade line account with incomplete information. The Fed finds this 
problematic. 

A key measure used in credit evaluation — utilization — could not be cor- 
rectly calculated for about one-third of the open revolving accounts in the 
sample because the creditor did not report the credit limit. About 70 per- 
cent of the consumers in the sample had a missing credit limit on one or 
more of their revolving accounts. If a credit limit for a credit account is not 
reported, credit evaluators must either ignore utilization (at least for 
accounts without limits) or use a substitute measure such as the highest- 
balance level. The authors’ evaluation suggests that substituting the highest- 
balance level for the credit limit generally results in a higher estimate of 
credit utilization and probably a higher perceived level of credit risk for af- 
fected consumers. [Emphasis added] ®'^ 

Although industry witnesses will testify to a vast “free flow of information” driv- 
ing our economy that should not be constrained, more and more firms are choosing 
to stifle the flow of information themselves — to maintain their current customers as 
captive customers. 

We expect industry witnesses to claim this problem has been resolved. According 
to the Fed and CFA studies it has not. This month, a major lender told the Amer- 
ican Banker newspaper it does not report credit limits: “Capital One has never re- 
ported credit limits, for proprietary reasons,” Diana Don, a spokeswoman for the 
McLean, VA, card issuer, said Wednesday. “We feel that it is part of our business 
strategy and provides competitive advantage.”®® 

When a bank intentionally fails to report a consumer’s complete credit report in- 
formation to a credit bureau, that consumer is unable to shop around for the best 
prices and other sellers are unable to market better prices to that consumer. Even 
the Comptroller of the Currency, Mr. Hawke, has condemned the practice.®® So has 
the FFIEC: “The Agencies are aware that over the last year some financial institu- 
tions have stopped reporting certain items of customer credit information to con- 
sumer reporting agencies (credit bureaus). Specifically, certain large credit card 
issuers are no longer reporting customer credit lines or high credit balances or 
both.” ®'^ 

Affiliate Sharing Regime Provides Fewer Consumer Rights 

As we have indicated above, the FCRA is an important privacy and consumer pro- 
tection law. It provides consumers with substantive rights. Yet the growing use of 
affiliate sharing under GLB for profiling and credit decisionmaking may lessen the 
public benefits of the FCRA. If credit decisions are made on the basis of affiliate- 
shared information, consumers do not have the same bundle of rights as they would 
under the FCRA. As internal creditor databases increase in size and predicative 


“An Overview of Consumer Data and Credit Reporting,” Avery et al, February 2003, 
Pages 47-73, Federal Reserve Bulletin http:! I www.Federalreserve.gov ! pubs ! bulletin ! 2003 ! 
0203lead.pdf. 

^‘^See page 71, “An Overview of Consumer Data and Credit Reporting,” Avery et al, February 
2003, Pages 47—73, Federal Reserve Bulletin http: U www.Federalreserve.gov ! pubs ! bulletin ! 
2003 /0203lead.pdf 

55 “FCRA Hearing to Shine Spotlight on Credit Process,” American Banker, 12 June 2003 by 
Michele Heller. 

®®See speech by Comptroller of the Currency John Hawke at http: II www.occ.treas.gov ! ftp ! 
releasel99-51.txt 7 June 1999: “Some lenders appear to have stopped reporting information 
about subprime borrowers to protect against their best customers being picked off by competi- 
tors. Many of those borrowers were lured into higb-rate loans as a way to repair credit his- 
tories.” According to U.S. PIRG’s sources in the lending industry, this practice continues. 

See advisory letter of 18 January 2000 at http: 1 1 www.ffiec.gov Ipress Ipr011800a.htm Testi- 
mony of U.S. PIRG, 26 June 2003, p.20. 
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value, either credit decisions or other profiling decisions (whether to even offer a 
consumer a certain class of product, for example) may more and more be made 
under the GLB regime. These adverse actions will not result in triggering the same 
disclosures and rights that consumers obtain under the FCRA. These changes in the 
marketplace, which are already occurring, mean that consumers may not have the 
same credit rights in the future. Congress should carefully scrutinize issues related 
to the lack of consumer rights in the affiliate sharing world, compared to the signifi- 
cant consumer protections provided by the FCRA. 

Conclusion 

Our complex national credit system, which relies on interrelationships between 
and among furnishers of information (creditors), consumer reporting agencies (credit 
bureaus) and numerous other information providers, secondary market players and, 
finally, consumers, was not created by the temporary 1996 preemption compromise 
to the FCRA and will not be destroyed by letting it expire. Nor was that complex 
national credit system created by the affiliate sharing regime of GLB which has re- 
sulted in a growing number of unregulated transactions and credit decisions. 

The FCRA worked well before 1996, as the testimony of the Vermont Attorney 
General’s office and other consumer witnesses has made clear today. Industry’s lob- 
b3dng campaign urging you to simply extend the temporary preemption and extend 
the nonregulation of affiliate sharing is merely an attempt to preserve the unaccept- 
able status quo that has resulted in unacceptable levels of credit report errors and 
an epidemic of identity theft. We hope to work with the Committee on solutions to 
these problems as well. 

We generally agree with industry that a uniform national law would be the most 
efficient, provided it is adequate. But the best way to get to adequate uniformity 
is to retain States’ rights. Congress has not demonstrated a propensity for enacting 
uniform consumer protection laws that are adequate, except when driven by the 
threat of State actions. If Congress fails to solve the problem, or new problems arise, 
the States can act more quickly to resolve the problem and provide a template for 
additional Federal action by the Congress. 

Retaining States’ right to enact stronger laws is the best way to guarantee an 
eventual strong uniform Federal law. The States are rational actors; they will not 
act to balkanize our financial system. Instead, they will respond to new threats with 
new and innovative ideas, which will eventually be adopted by other States. The no- 
tion of 50 different, conflicting laws is absurd and not even worth debate. 

In the area of consumer protection, without ideas from the States, typically the 
only way the inertia of Congress is ever overcome is by a stark crisis — such as 
Enron. Remember, the Enron fiasco was not even enough to guarantee passage of 
last year’s Sarbanes-Oxley corporate reforms — we had to wait for Worldcom. 

We appreciate the opportunity to provide our views on the Fair Credit Reporting 
Act and affiliate sharing. We look forward to working with you in the future on 
these and other solutions to the problems consumers face in dealing with creditors, 
furnishers, and identity theft. 


PREPARED STATEMENT OF ANGELA L. MAYNARD 

Chief Privacy Executive and Counsel, KeyCorp 

ON BEHALF OF THE ElNANCIAL SERVICES ROUNDTABLE 

June 26, 2003 

Mr. Chairman and Members of the Committee, my name is Angela Maynard, and 
I am the Chief Privacy Executive and Counsel for KeyCorp (Key), an $86 billion fi- 
nancial holding company headquartered in Cleveland, Ohio. As the nation’s 11th 
largest banking company. Key conducts business throughout the United States in 
States spanning from Maine to Alaska. 

Key is a member of the Financial Services Roundtable (Roundtable), and I am ap- 
pearing today on behalf of the Roundtable as well as the customers, employees and 
shareholders of Key. The Roundtable represents 100 of the largest integrated finan- 
cial services companies providing banking, insurance, and investment products and 
services to consumers. Member companies participate through their chief executive 
officer and other senior executives nominated by the CEO. 

I appreciate the opportunity to testify before the Committee on the role of affiliate 
information sharing under the Eair Credit Reporting Act (FCRA). The FCRA has 
become central to our Nation’s credit system, and the Committee is to be com- 
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mended for undertaking a thorough review of the Act and its impact on consumers, 
businesses, and the economy. 

The Roundtable and Key support the affiliate information sharing provisions of 
the FCRA, and urge the Committee to renew those and the other provisions of the 
Act that are scheduled to expire at the end of the year. 

The Importance of the FCRA and the Consumer Benefits of Information 
Sharing 

Before I explain how Key uses the affiliate information sharing provisions of the 
FCRA, I thought it might be useful to provide the Committee with some insight into 
the importance of the FCRA to the economy and the consumer benefits associated 
with affiliate information sharing. 

Economic Consequences of Failing to Renew the FCRA 

The Roundtable has found that the failure to renew key provisions of the FCRA 
will impose substantial costs on consumers and the economy, and will raise barriers 
to the least advantaged segments of our population. ^ More specifically, the Round- 
table has found that the failure to renew key provisions of the FCRA will result in 
higher costs for interest on mortgages, credit cards, and other debt; reduced credit 
access; and higher costs for insurance, electric power (in competitive markets), mail- 
order and e-commerce purchases, and third-party offerings by financial services 
companies. 

The additional costs consumers would pay on mortgages and other forms of credit 
are estimated to total over $20 billion each year. This amount includes $1.7 billion 
in new mortgage expenses, $1.7 billion in additional home equity and refinancing 
costs, and over $11 billion in increased credit card charges. The increased annual 
costs for insurance, electric power, e-commerce sales, and third party services are 
estimated to total another $20 billion. 

Additionally, approximately $170 billion in total funds from home equity loans 
and refinancings would no longer be available to households. Of this amount, ap- 
proximately $100 billion would otherwise have been spent and circulated through 
the economy. 

When these and other cost factors are combined, the net direct loss in annual ag- 
gregate spending from the failure to renew the FCRA is estimated to be over $180 
billion. 

Consumer Benefits of Information Sharing 

The Roundtable also has found that the customers of its member companies ob- 
tain significant benefits from information sharing.^ These benefits include increased 
convenience, personalized service, and real savings of time and money. 

Information sharing saves the customers of Roundtable companies, on average, 
$195 per household per year. For all customers of Roundtable companies, the total 
dollar savings due to information sharing is estimated to be $17 billion. About $9 
billion of this total comes from sharing information with third parties, and the re- 
maining $8 billion is due to information sharing with affiliates. The dollar savings 
for customers result from the outsourcing of services to third parties, relationship 
pricing, and proactive offers. Obviously, these savings would be greater for the en- 
tire financial services industry. 

Information sharing also saves time for the customers of Roundtable companies. 
The average household saves close to 4 hours per year because of the convenience 
provided by information sharing. This amounts to a savings of about 320 million 
hours per year for all customers of Roundtable companies. About 115 million hours 
are saved because of information sharing with affiliates and 205 million hours are 
saved because of information sharing with third parties. The timesavings for cus- 
tomers are a result of centralized call centers, Internet-based services, third party 
services, proactive offers, and prefilled applications. 

The Roundtable also has found that, contrary to common perception, the ability 
to share information reduces identity theft and fraud, and that it reduces the num- 
ber of solicitations consumers actually receive. Identity theft and fraud are reduced 
because information sharing allows organizations to better identify and respond to 
fraud and identity theft. Solicitations are reduced as a result of targeted marketing. 
Roundtable members save about $1 billion per year through the use of targeted 
marketing, as opposed to mass marketing, and those costs savings can be passed 


i“The Economic Consequences of Failing to Renew Current Provisions of the Fair Credit Re- 
porting Act (FCRA) Which Promote Uniform National Standards,” a study prepared for the Fi- 
nancial Services Roundtable by the Perryman Group, 2003. 

2 “Customer Benefits from (Current Information Sharing by Financial Services Companies,” a 
study prepared for the Financial Services Roundtable by Ernst & Young, December 2000. 
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forward to customers. Failure to renew the FCRA could result in a shift back to 
mass marketing and cause Roundtable members to send out over three times as 
many solicitations to achieve the same level of sales. 

How Key Uses Information Sharing To Benefit its Customers 

Like many other financial services companies, Key is a holding company that 
owns a number of subsidiary companies, all of which would qualify as affiliates for 
purposes of the FCRA. At present, KeyCorp owns approximately 20 companies that 
provide products and services directly to individuals, including: KeyBank, N.A.; Key 
Bank U.S.A, N.A.; McDonald Investments, Inc.; Victory Capital Management, Inc.; 
Key Bank Life Insurance, Ltd.; KeyTrust Company, N.A.; and SecoLink Settlement 
Services, LLC. 

Key has worked diligently to consolidate the legal affiliates under which we con- 
duct business. Key was the first large multibank holding company to consolidate 
bank charters under the authority provided by the Riegle-Neal Act. Despite our ef- 
forts, we still must operate under multiple legal affiliates due to State and Federal 
legal requirements, tax and accounting considerations, and operational consider- 
ations. For example, the Gramm-Leach-Bliley Act (GLBA) requires many of Key’s 
financial activities be conducted separate and apart from our banking subsidiaries. 

However, to our customers. Key is not a collection of separate companies; it is a 
single entity that offers a variety of financial products and services. These include 
retail and commercial banking; investment banking and management; residential 
mortgages; home equity and installment loans; financial, estate, and retirement 
planning; asset management; and, for our business customers, real estate finance 
and equipment leasing. 

Despite this structure, Key has a single privacy policy that covers all of our busi- 
nesses. This policy discloses our practices regarding the collection and sharing of in- 
formation with both affiliated and nonaffiliated companies. Key has had a privacy 
policy in existence for 6 years, which predates GLBA’s privacy policy requirements. 

Through our privacy policy, any consumer who provides information to Key can 
learn the types of information we may collect, from whom, how that information 
may be used, and how he or she can restrict the use of this information across our 
company and with third parties. We provide a copy of our privacy policy at the time 
a consumer first provides the information to Key, whether or not an account is 
opened, and annually, so long as a relationship exists with Key. Disclosed in the 
privacy policy is a toll-free number that is dedicated solely to recording privacy elec- 
tions and answering privacy related questions. Once recorded, a privacy election is 
applied corporate-wide, covering all Key affiliates, and stays in effect until changed 
by the individual. 

The FCRA has two provisions related to the sharing of information among affili- 
ated companies. One provision relates to information about a customer that is based 
on a company’s own transactions with the customer (so-called “transaction and expe- 
rience” information). The other provision relates to any other information about a 
consumer, including information based on the consumer’s transactions with other 
institutions (so-called “other” information). 

Transaction and experience information is information that relates to a company’s 
own experiences and transactions with a consumer. It would include, for example, 
the length of time that a customer has held a credit card, the number of times the 
customer has been late in making a payment on the credit card, or the average 
monthly balance in the customer’s savings account. Under the FCRA, transaction 
and experience information that is shared with an affiliate is not treated as a credit 
report. Also, a customer does not have the ability to elect not to allow Key to share 
such information within the Key family of companies. Key’s affiliates share this type 
of information for many purposes, including customer risk assessments, the serv- 
icing of accounts, fraud control, and targeted marketing. 

Examples of other information, that is nontransaction and nonexperience informa- 
tion, include information on an application, lists of a consumer’s assets and liabil- 
ities with other companies, and lists of the names of companies from whom the 
customer has purchased other financial products and services. Under the FCRA, 
such other information that is shared with an affiliate is not treated as a credit re- 
port as long as a consumer is notified that such information may be shared and is 
given the opportunity to opt out of having this information shared. This provision 
permits Key’s affiliated companies to share all types of information maintained on 
customers, not just information on our own transactions or experiences with the cus- 
tomer, provided the customer does not “opt out” of the sharing. 

These two provisions were added to the FCRA in 1996 to accommodate the flow 
of information within organizations, such as Key, which provide products and serv- 
ices to consumers through multiple legal entities. Absent these exceptions to the def- 
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inition of what constitutes a consumer report, Key’s affiliates would be treated as 
consumer reporting agencies under the FCRA and would be able to share consumer 
information only in limited circumstances, such as a credit transaction, the under- 
writing of insurance, or for employment purposes. Key uses the affiliate information 
sharing provisions of the FCRA in many other ways to help consumers. It relies 
upon affiliate information sharing to help consumers obtain needed products and 
services and service customer accounts. It also uses affiliate sharing to fight fraud 
and identity theft, and to comply with anti-money laundering and anti-terrorist fi- 
nancing laws. The following is a summary of the many ways in which Key uses affil- 
iate information sharing to benefit consumers. 

Appropriate Product and Services 

Our customers expect us to help them identify appropriate financial products and 
services. Affiliate information sharing permits us to efficiently and effectively pro- 
vide products and services that meet the specific needs of our customers. To do so, 
we first must understand a customer’s financial needs and risk profile. Affiliate in- 
formation sharing allows us to gather this data. Once we have an understanding 
of a customer’s financial needs and risk profile, including an understanding of the 
existing product and service relationships the customer maintains across Key, we 
can determine what products and services are best for the customer, from both a 
product function and cost perspective. Without affiliate information sharing, our 
customers would be at a disadvantage in terms of product selection and cost. 

One-Stop-Shopping 

Our customers want to minimize the time it takes to conduct business. Affiliate 
information sharing allows us to deliver financial products and services efficiently. 
It eliminates the need for our customers to deal separately with different Key em- 
ployees at multiple locations in order to obtain products and services that are of- 
fered by Key through separate legal affiliates. For instance, if a customer goes to 
a Key branch to open a deposit account, the same employee can assist that indi- 
vidual with other products, such as a home equity line that is offered by a separate 
Key affiliate. Affiliate information sharing also accelerates account approval and 
opening processes by leveraging information Key already maintains on the customer 
to process the customer’s request. This eliminates the need for a customer to spend 
time gathering papers and finding information necessary to proceed with a product 
request. 

Integrated Products and Services 

Key offers several products that straddle affiliates. For example. Key’s Total Ac- 
cess Account connects a brokerage account to a bank deposit account. This enables 
us to swap funds back and forth to maximize the return on a customer’s funds. Cus- 
tomer information must be shared between our brokerage and bank to allow these 
products to co-exist. Combined statements and online account aggregation services 
are other examples of services that benefit our customers, and that are a direct re- 
sult of affiliate information sharing. 

Relationship -Based Discounts 

Key strives to maintain and grow customer relationships. One way we achieve 
this goal is through relationship-based pricing and discounts for customers who 
maintain multiple accounts across Key. The number and mix of products and serv- 
ices a customer maintains across Key impacts the profitability of a customer, which 
allows Key to provide certain customers with discounts and preferential pricing. Af- 
filiate information sharing allows Key to perform the analysis necessary to deter- 
mine which customers qualify for discounts or other pricing breaks. The benefit to 
the customer in this case is clear: Advantageous pricing. This benefit is a direct re- 
sult of affiliate information sharing. 

Ease for Clients 

Affiliate information sharing supports our ability to effectively service customers. 
It allows us to respond to customer inquires. With access to shared information, a 
bank branch representative can assist a customer who may have questions con- 
cerning the customer’s brokerage and deposit accounts. Information sharing also en- 
ables a centralized department to update customer information for accounts held at 
any Key affiliate. This saves the customer the time and nuisance of separate visits 
and multiple telephone calls. Furthermore, information sharing helps Key manage 
data quality. When personal information related to a customer is changed at one 
affiliate, information sharing enables us to reflect that change in other accounts 
held throughout the organization. Maintaining the accuracy of customer information 
is critical in the fight against identify theft. 
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Effective Solutions 

Information sharing helps Key provide the best possible financial solutions to its 
customers. For example, when determining the best source for funds needed by a 
customer, a Key representative can identify more opportunities with a full under- 
standing of the client’s relationship across Key. Utilizing information sharing, the 
Key representative may discover that the customer has a home equity line with a 
Key company and may conclude that the home equity line is a less expensive source 
of funds than the credit card limit extension the customer may have requested. 

Increased Efficiencies / Decreased Costs 

Centralizing functions — such as call centers, operations centers, analytics, and 
product development — all require information sharing across affiliates. The central- 
ized functions enable the same Key employees to effectively and efficiently perform 
nearly identical functions for different affiliates within our organization. Consoli- 
dating functions across affiliates improves expertise, allows us to better manage 
risks, and significantly reduce operating expenses. These benefits are passed on to 
the customer in the form of better service and lower costs. If affiliate information 
sharing is restricted, it would force Key to decentralize and duplicate functions 
within the organization, with no benefit to customers. 

Well-Suited Offers 

Key uses information sharing to determine which products or services to market 
to our customers. We strive not to annoy our customers with offers for products or 
services that do not fit their needs. We know that customers only will choose new 
products or services if those products or services fill a specific need. Efforts to mar- 
ket the wrong products and services to our customers benefit no one. In order to 
ensure that our marketing efforts benefit our customers, we conduct the necessary 
analysis of the information we have available to us to understand our customers’ 
needs. This does not mean that we will market products to those who have re- 
quested us not to solicit them. For many years. Key has provided its retail and busi- 
ness customers the option to not receive marketing from Key if they chose. 

Uncovering Fraud 

Information sharing among affiliates is critical in our efforts to fight fraud. Orga- 
nized crime groups conduct the majority of fraud committed against financial insti- 
tutions. These groups know the requirements under which we operate and “game” 
the system. They know where and how we can share information, and play that 
against us. They know the legal restrictions we operate under and the technology 
we utilize. When a financial institution is the target of fraud, it generally is not an 
isolated incident; criminals strike at multiple points across the organization. Gath- 
ering and sharing information on the impacted accounts across the organization is 
the only means to effectively address this problem. In these situations, information 
must be retrieved from employees in closest contact with the accounts, as well as 
the individuals who established the accounts. The information must be shared with 
those involved throughout the organization involved to help uncover the totality of 
the fraud. 

Preventing Fraud 

Key uses information sharing to help prevent fraud before it occurs. Some of our 
processes check existing information we have on a customer against information we 
receive when an account is established. If the information appears suspicious upon 
comparison, our employees take a closer look to uncover attempted fraud. By shar- 
ing information across the entire organization, not just within an affiliate, we have 
a much greater opportunity to stop fraud before it happens. 

Affiliate information sharing is also a critical component of Key’s compliance ef- 
forts with OFAC requirements, suspicious activity reporting requirements, and anti- 
money laundering and anti-terrorist financing requirements. 

Easing the Impact on Victims 

Having access to information across affiliates increases the speed with which Key 
can react when assisting a victim of fraud or identity theft. Systems that house in- 
formation across the company are a tremendous tool in aiding an identity theft 
victim. By placing one call to our fraud unit, a customer can, within a few minutes, 
have confirmation that a check was fraudulently passed, and can obtain credit to 
his or her account. This is possible through access to an imaging system that con- 
tains copies of checks that can be searched and viewed within seconds to compare 
signatures on checks and an accounting system that permits accounts to be ad- 
justed. Our fraud unit is centralized to support this function corporate- wide. In 
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order for the unit to work properly, it is necessary for all affiliates to share informa- 
tion with the unit. 

Our centralized fraud unit also allows a customer one point of contact within our 
organization. This avoids the need for the customer to make separate phone calls 
to the different affiliates that may be involved. Additionally, our centralized fraud 
unit benefits the company by making us more effective in successfully investigating 
the crimes and quickly getting information to law enforcement to aid in potential 
recoveries. 

When identity theft does occur, affiliate information sharing enables us to ease 
the victim’s burden of clearing the many difficult issues that are often encountered. 
For instance, in the process of reestablishing a customer’s accounts after an identity 
theft has occurred, it is essential to quickly access information across affiliates on 
the affected accounts. This is critical in lessening the hardship that would otherwise 
linger for the victim. 

Consumer Protections 

I have described how Key shares information among affiliates for the benefit of 
its customers. Key is equally concerned about protecting customers from unwanted 
distribution of information: 

• Key has stringent information access restrictions across the company. 

• We train our employees (23,000+) annually on the importance of privacy and its 
requirements. 

• Key does not share medical information among affiliates for any reason not re- 
lated to the servicing of the account or product. 

• Any consumer who provides personal information to Key is informed of our infor- 
mation sharing practices. 

• Consumers can opt out of the sharing of nontransaction and experience informa- 
tion among affiliates. We inform consumers of this right, and provide them with 
our toll-free Privacy Line number to exercise the right. 

• Consumers are notified of any adverse decisions based upon information contained 
in a credit report, and given the opportunity to dispute that information. 

Conclusion 

In conclusion, the Roundtable and Key support the affiliate sharing provisions of 
the FCRA. We firmly believe that the statute strikes an appropriate balance be- 
tween consumer protection and corporate structure. It permits financial services 
companies, like Key, to offer a full range of products and services to consumers in 
a convenient and efficient manner resulting in real benefits and savings for our cus- 
tomers. At the same time, it permits consumers to block unwanted information 
sharing and helps protect against identity theft. We urge the Committee to make 
the existing provisions of the FCRA permanent and thereby reaffirm our national 
credit system. 
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RESPONSE TO WRITTEN QUESTIONS OF SENATOR SHELBY 
FROM TERRY BALOUN 

Q.l. What level of understanding does the average consumer have 
with respect to affiliate sharing? 

A.l. The average consumer has little understanding of affiliate 
sharing. The consequences of that misunderstanding may vary con- 
sideraWy, depending on how a particular business is organized. 
Wells Fargo, for example, has a separate banking affiliate in al- 
most every State in its banking footprint, and separate credit card 
and home mortgage entities. Few, if any, customers want to be 
treated as a stranger if they try to conduct business in a branch 
outside their home State. Customers expect to be able to make pay- 
ments on their Wells Fargo credit cards and mortgages in any 
Wells Fargo branch, even though those products are offered by dif- 
ferent legal entities. Even when the affiliates are in different lines 
of business, for example banking and securities brokerage, most 
customers expect that their overall relationship with “Wells Fargo” 
will be considered in determining whether they qualify for certain 
benefits; they would not want the value of their relationship meas- 
ured based solely on the balances in bank accounts if they also 
maintain a sizable securities portfolio with us. Indeed, to provide 
intelligent financial solutions for many customers, it is necessary 
to understand their overall financial picture — including invest- 
ments and insurance, as well as banking relationships. In most 
cases, when consumers “opt out” of information sharing — with af- 
filiates or with third parties — what they are really trying to 
achieve is a reduction in direct marketing solicitations. That con- 
cern is already addressed by State and Federal laws establishing 
“opt out” mechanisms for telemarketing calls, fax and e-mail adver- 
tising, and prescreened solicitations. 

Q.2. Does the number of affiliates a firm has affect this under- 
standing? 

A.2. See #1 above. The sheer number of affiliates is less important 
than the complexity of the organization in terms of different lines 
of business. In many cases, the number of affiliates is a red her- 
ring. For example, more than two-thirds of Wells Fargo’s affiliates 
have no consumer-oriented business and thus are unlikely to have 
any use for consumer data; we believe the same is true for most 
other large financial institutions. 

Q.3. What about situations where the affiliates are engaged in en- 
tirely different lines of business? Does it matter that a person rec- 
ognizes that they have a relationship with a bank but may not 
know that the bank also owns a retail securities brokerage oper- 
ation or a direct mail operation where this information would be 
used and other things? 

A.3. See #1 above. Few customers would be well served if any fi- 
nancial institution tried to meet all their financial needs in a single 
entity or line of business. Insurance and securities investments are 
an important part of the overall financial security of most cus- 
tomers but, for regulatory reasons, insurance and securities broker- 
age activities cannot be conducted by banks. The main purpose of 
the Gramm-Leach-Bliley Act was to facilitate coordinated offerings 
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of different types of financial products by integrated financial insti- 
tutions. Cutting off the flow of customer information among the 
various parts of such an institution would largely undo the benefits 
foreseen in the GLBA. 

Q.4. How important is a firm’s brand to consumers in establishing 
their expectations with respect to the kind of relationship they 
have with a company? 

A.4. Branding is extremely important in setting consumer expecta- 
tions, and this is reflected in the branding policies of most con- 
sumer-oriented businesses. For example, it may make economic 
sense for the same hotel chain to operate very different level hotels 
in the same market, but it would be madness to operate a $500 per 
night hotel under the same brand as a $59 per night hotel. Both 
serve the needs of important market segments, but someone walk- 
ing into a Best Western does not expect the amenities — or the 
prices — of the Ritz, and someone walking into the Ritz does not ex- 
pect the amenities or the prices of a Best Western. The same is 
true in financial services. Wells Fargo, like most other large finan- 
cial institutions, uses a common brand name for its mainstream 
consumer financial businesses. (In the case of acquired businesses, 
there is often a transition period during which the old name is re- 
tained.) If a different brand is used for a part of the business, it 
is usually because that segment serves a specialized market seg- 
ment, for example, investment advisory services for high net worth 
individuals. Different brands may also be used for some noncon- 
sumer businesses. Even where separate brands are employed, the 
corporate family name is often identified as well; that is, “XYZ 
Corp., a Wells Fargo company.” 

Q.5. How important is that brand? 

A.5. Brand reputation is extremely important to any consumer-ori- 
ented business. See #4 above and #6 below. 

Q.6. Should there be safeguards, or best practices for sharing infor- 
mation within affiliates? 

A.6. Yes, but such “safeguards” and “best practices” do NOT need 
to be imposed by legislative mandate. Misuse of customer informa- 
tion almost always comes to light, usually sooner rather than later. 
Businesses such as financial service providers have substantial mo- 
tivation to maintain the trust and goodwill of their customers, and 
they know that nothing will erode that trust and goodwill faster or 
more permanently than misuse of customer information. If any 
Wells Fargo business is discovered to have misused customer infor- 
mation, the reputation of the entire enterprise will be sullied. We 
have substantial information to ensure that all our businesses use 
customer information responsibly without legislative mandates 
around the sharing of information with affiliates. The existence of 
such mandates would provide little additional incentive to use cus- 
tomer information responsibly, but would stifle innovation and 
competition. 

Q.7. While called “affiliate” sharing provisions, these provisions ac- 
tually allow companies to share information with entities that are 
outside their affiliate structures, don’t they? Why is this necessary 
and does this make sense? 
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A.7. The “affiliate sharing” provisions of the FCRA in no way per- 
mit sharing of information outside of the “affiliate structure” or 
“corporate family” at least with respect to financial institutions. 
Sharing with nonaffiliates is governed by Title V of the GLBA. If 
the affiliate where the information originates could not share it 
with a nonaffiliated third party, an affiliate who receives that in- 
formation will also be prohibited from sharing it with a non- 
affiliated third party. 

Q.8. Do consumers have different concerns with respect to affiliate 
sharing versus third party sharing? 

A.8. Clearly their concerns are different in degree, if not in kind; 
far fewer customers opt out of affiliate sharing than opt out of third 
party sharing. Most customers are unaware of the corporate entity 
structure of most businesses. If anything, they expect that legal 
entity boundaries will be transparent to them. In our case, a Cali- 
fornia bank customer expects to be treated as a Wells Fargo cus- 
tomer and not a stranger in a Wells Fargo Bank in another State, 
or if s/he applies for a Wells Fargo mortgage or credit card, even 
though those are all different legal entities. That seamless cus- 
tomer experience simply would not be possible if customer informa- 
tion could not flow freely among Wells Fargo affiliates. 

Q.9. Should there be greater control over sharing information out- 
side of an affiliate structure than within? In other words, should 
this provision be limited so that the only type of information shar- 
ing permitted is sharing within affiliated entities? 

A.9. This is already the case for financial institutions: Sharing of 
information within the “corporate family” is governed by the FCRA 
while sharing of information with unaffiliated third parties is gov- 
erned by Title V of the CLBA and, if applicable. State or local laws 
which may be even more restrictive than Federal law. 

Q.IO. Do financial institutions make underwriting decisions with- 
out using credit reports? 

A.IO. Cenerally, no. In most cases internal information and infor- 
mation obtained from affiliates — which may be much more detailed 
than the information in credit reports — is used to supplement the 
credit report when an existing customer applies for credit. In some 
limited instances, a long-standing relationship with the institution 
(including its affiliates) may be considered sufficient to forego the 
use of a credit report for certain products. 

Q.ll. There are a range of sharing activities that you are per- 
mitted to engage in under the law. Have any of your firms decided 
NOT to take advantage of the full range of these sharing activi- 
ties — are there things you could do but don’t do, and if so, why 
don’t you do these things? 

A.ll. Wells Fargo does not share information with nonaffiliated 
third parties for marketing nonfinancial products or services with- 
out the customer’s explicit consent, even though the CLBA and al- 
most all State laws permit doing so subject to notice and opt out. 
Wells Fargo also permits its customer to opt out of information 
sharing with other financial institutions under “joint marketing 
agreements” even though the CLBA permits such sharing without 
an opt out opportunity. (However, we recognize the importance of 
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the joint marketing agreement exception to smaller institutions 
which cannot provide the same range of financial products inter- 
nally.) Wells Fargo permits its customers to opt out of sharing any 
information with affiliates for marketing purposes, even though the 
FCRA permits sharing identifying and “transaction and experience” 
information with no opt out. Wells Fargo also permits its customers 
request solicitation restrictions in addition to those required by 
law; for example do not mail and do not e-mail, even for current 
customers. 

RESPONSE TO WRITTEN QUESTIONS OF SENATOR RUNNING 
FROM TERRY BALOUN 

Q.l. Are there simple ways to make the opt out notice clearer to 
the consumer without having to send out the long and drawn out 
privacy notices. I think that if it was clear, whether that means 
bold print, a larger check off box, or a simple and precise expla- 
nation, it would eliminate some of the apprehension some have. Do 
you agree/disagree? 

A.l. Since enactment of Gramm-Leach-Bliley, Wells Fargo has un- 
dergone a process to evaluate content and style of its privacy no- 
tices and have made improvement. We believe that there are steps 
that each company can take to ensure the ready availability of no- 
tices and opt out opportunity, for example brochures available on 
bank branch counters. Wells Fargo would recommend that Con- 
gress provide sufficient flexibility to regulators to allow for simpler 
notices. 

If there is a problem with consumer privacy notices, it is that 
they are too long and too complex. Virtually all the experts in this 
area agree that privacy notices should be shortened, simplified, and 
standardized (to enhance comparability). For many — perhaps 
most — financial institutions, it would be extremely cumbersome 
and expensive to maintain and distribute 50 different notices (even 
small, local institutions are likely to have some customers who re- 
side in different States). Thus the likely response to different re- 
quirements in different States would be an attempt to develop 
“one-size-fits-all” notices that would meet the requirements of all 
the States, and which would be neither short nor simple. 

Q.2. What unintended consequences do you foresee for some of the 
proposals that would change the current affiliate sharing status 
quo? 

A.2. Wells Fargo’s customers expect seamless service across busi- 
ness lines. A change to the existing framework would hamper that 
service, if not bring it to a halt. As I mentioned in my testimony, 
new homeowners and small business owners have access to credit 
available to them as a result of our analysis of data. Products are 
offered on a timely and nationwide basis. Wells Fargo is a financial 
services provider and should be allowed to structure itself in a way 
that allows the company to offer financial products to its cus- 
tomers. 

The United States currently enjoys historically low interest rates 
on almost all credit products, and greater access to credit for all 
economic segments than has ever been true in the past. While the 
Fed’s monetary policy due to the economic slump has been a factor. 
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the decline in consumer interest rates began long before the eco- 
nomic downturn. Interest rates in the United States are also lower 
than in almost any other country on earth. Long-term, the decline 
in consumer interest rates in the United States has been driven by 
three primary factors: 

• Better risk assessment. 

• National competition. 

• An active and efficient secondary market for consumer credit re- 
ceivables. 

All three of these forces depend on accurate, complete, and con- 
sistent credit information on a nationwide basis, and thus would be 
endangered if different States had different laws on information 
sharing and credit reporting. 

Q.3. What are some of the difficulties financial services companies 
might have in marketing to a community where there are multiple 
privacy standards? 

A.3. If California’s nine pending local ordinances go into effect. 
Wells Fargo will not be able to automatically service/contact cus- 
tomers in those local markets. 

Our experience in North Dakota shows that Wells Fargo now has 
a customer base in rural markets of North Dakota that do not see 
information related to insurance products. Conforming with 
Gramm-Leach-Bliley, the North Dakota legislature changed its opt 
in law to opt out with respect to information sharing with outside 
third parties for financial purposes. But this was reversed by a 
2002 referendum election to return to an opt in standard — requir- 
ing banks to get customer approval before providing financial serv- 
ices offered by a third party financial services company. Wells 
Fargo expects that the result will have an impact on North Dako- 
ta’s rural communities. To ensure compliance. Wells Fargo has, in 
effect, placed all the residents of North Dakota on a do-not-contact 
list regarding insurance products and is not providing any unsolic- 
ited information. Customers have opportunities for a broad array 
of financial products and North Dakota’s State action has the re- 
sult of preventing rural access to that product list. 

Q.4. Do you think that a company that has stringent privacy prac- 
tices (the good guys) would open itself up to unnecessary litigation 
if it has to adhere to multiple privacy standards? 

A.4. Yes. 

Q.5. Do you think that a company that does business in an area 
that institutes multiple privacy standards will choose to stop doing 
business in that area? 

A.5. Again, we would refer to our experience in North Dakota. Con- 
forming with Gramm-Leach-Bliley, the North Dakota legislature 
changed its opt in law to opt out with respect to information shar- 
ing with outside third parties for financial purposes. But this was 
reversed by a 2002 referendum election to return to an opt in 
standard — requiring banks to get customer approval before pro- 
viding financial services offered by a third party financial services 
company. Wells Fargo expects that the result will have an impact 
on North Dakota’s rural communities. To ensure compliance. Wells 
Fargo has, in effect, placed all the residents of North Dakota on a 
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do-not-contact list regarding insurance products and is not pro- 
viding any unsolicited information. Our customers outside of North 
Dakota have opportunities for a broad array of financial products 
and North Dakota’s State action has the result of preventing rural 
access to that product list. 

Q.6. How many customers actually opt out of information sharing 
with affiliates? 

A.6. Wells Fargo has had a very small percentage. I would note 
that Wells Fargo offers an annual opt out opportunity for a cus- 
tomer — which is over and above what is currently required by the 
Fair Credit Reporting Act. Opt out rates have not increased signifi- 
cantly over the past 5 years, despite annual notices and extensive 
media attention. 

RESPONSE TO WRITTEN QUESTIONS OF SENATOR SARBANES 
FROM TERRY BALOUN 

Q.l. Please identify the specific types of transaction/experience in- 
formation about its customers that the bank keeps on file. Which 
types of data does your bank share with one or more affiliates for 
purposes other than servicing an account or fraud prevention? Does 
your bank or a bank affiliate combine your customer data with in- 
formation purchased from other sources to create a fuller picture 
of your customer? If so, what specific types of information do you 
receive from these other sources and for what purposes is the com- 
posite information used? 

A.l. Information is generally made available to affiliates by grant- 
ing access to the centralized customer information system which 
contains primarily account-level information or, in some cases, to 
systems of record with more detailed transaction information. For 
example, employees who answer customer service telephone calls 
may need access to detailed transaction information in order to re- 
spond to questions about specific checking or credit card trans- 
actions. Access to all customer information, whether within the 
same legal entity or across affiliates is restricted on a “need to 
know” basis; employees of affiliates which do not provide consumer 
products and services would not have access to any information 
about any consumer customers. Extensive physical, technical, and 
procedural safeguards are employed to protect customer informa- 
tion at all stages. These safeguards, in turn, are reviewed and ap- 
proved by our respective Federal regulators. 

Wells Fargo obtains information from credit bureaus as part of 
an application/credit granting process. Wells Fargo needs to have 
the most complete and current financial picture of an individual 
applying for credit. As a general matter. Wells Fargo supports full 
and equal reporting of credit information, and we support the ef- 
forts of the credit reporting agencies and the financial regulators 
to encourage full reporting. However, we also recognize that the 
United States has a voluntary system of credit reporting that has 
worked very well over many years. A change as fundamental as 
mandatory credit reporting would undoubtedly have many unfore- 
seen consequences. Therefore, we urge Congress to encourage full 
voluntary credit reporting, which it best can do by maintaining the 
existing limits on the liability of reporting entities. 
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Q.2. Professor Reidenberg in his testimony wrote “The FCRA cre- 
ated fundamental fairness in the treatment of personal information 
through adherence to the basic principle that information collected 
for one purpose should not be used for different purposes without 
the individual’s written consent.” Do you agree or disagree that “in- 
formation collected for one purpose should not be used for different 
purposes without the individual’s written consent”? Why? 

A.2. I am not sure how you define ownership in the context of a 
company that wants to provide services of value to customers. 
“Ownership” is not a very useful concept when applied to informa- 
tion. “Ownership” of a physical object implies total control to the 
exclusion of others. The same piece of information, on the other 
hand, can be used by many people, often without diminishing the 
value to any other user. Thus the question should be, “What uses 
should a particular party be allowed to make of a particular piece 
of information.” The information of interest to financial institutions 
primarily arises from the relationship between the institution and 
its customer, and secondarily from information each furnishes to 
the other — directly, for example on an application, or indirectly, for 
example from a credit report — in connection with that relationship. 
It seems that both parties should have the right to use information. 

Q.3. What is the total number of affiliates that the bank has and 
what lines of business are the affiliates engaged in? Does the bank 
disclose to customers the identities of the affiliates which it may 
share their confidential financial data and their lines of business? 
A.3. Wells Fargo has roughly 800 legal entities — so-called affili- 
ates — ^but only 38 are considered to be national businesses (per 
Wells Fargo’s annual report); approximately one quarter of the 800 
number actually uses consumer data. Moreover, Wells Fargo is 
structured so that data is available based on what is relevant to 
a particular business line and if other affiliates want access, the 
entity has to prove business use/need and request clearance by 
Wells Fargo Information Security. These firewalls and processes 
are examined by our Federal banking regulators. The Committee 
should also keep in mind that as we acquire other financial compa- 
nies, we may elect to keep them operating in their existing struc- 
tures, so our so-called affiliate number fluctuates. 

Q.4. On June 19, 2003, at the Banking Committee’s hearing on 
identity theft, a witness from the Secret Service wrote, “With lower 
costs of information processing, legitimate companies have found it 
profitable to specialize in data mining, data warehousing, and in- 
formation brokerage. . . . This has led to a new measure of growth 
within the direct marketing industry that promotes the buying and 
selling of personal information.” He went on to write that such 
data are “valuable commodities.” How valuable is this data? If a 
bank were to buy such data on customers, how much would it cost? 
A.4. Wells Fargo cannot judge the value of collected data and can- 
not speculate on the cost. Wells Fargo is a financial services com- 
pany and for credit granting, relies on the most current available 
credit report in order to complete a transaction/approve credit. 

Q.5. Do your affiliates use transaction/experience data from your 
customers in making decisions of whether to grant credit, for pur- 
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poses other than fraud prevention? If so, please describe with speci- 
ficity what information is used and how it is used in deterring 
whether to extend credit? 

A.5 Wells Fargo maintains one centralized database. The cost of 
developing systems, plus a mobile customer base, and the need to 
comply with multiple State rules — will result in confusion for both 
the customer and our employees if a separate database is required 
for fraud control and another database for credit granting. 

Because of a centralized database, affiliate sharing does control 
fraud perpetrated against Wells Fargo businesses. Our tellers are 
our front line of defense in controlling fraud and can only do that 
because they have a full screen of information in front of them. 

A centralized database also allows relevant businesses to provide 
credit along with the most current credit bureau report. In general, 
with affiliate sharing of information, my company can offer bene- 
ficial rates and streamlined services to individuals with their bro- 
kerage accounts, to mortgage customers, to small businesses. For 
example, credit card issuers today provide credit on a nationwide 
basis and instantly — in contrast to 5-10 years ago, when such cred- 
it granting required a relationship with a banker; mortgage compa- 
nies can offer its existing customers beneficial rates and quick 
turnaround on refinancings; with low interest rates, investment/fi- 
nancial planners can advise customer on safe financial products to 
get better return for their investments. 

RESPONSE TO WRITTEN QUESTIONS OF SENATOR DOLE 
FROM TERRY BALOUN 

Q.l. Some of my colleagues have made the point that some banks 
have thousands of affiliates. Ms. Brill also lists the number of af- 
filiates for Keycorp and Citigroup in her prepared statement. Can 
you explain why this is and how many of these affiliates actually 
deal in customer information? 

A.I. Yes. Wells Fargo has roughly 800 legal entities — so-called af- 
filiates — ^but 38 are considered to be national businesses (per an- 
nual report) and roughly a quarter of the 800 number actually use 
consumer data. Moreover, Wells Fargo is structured so that data 
is available based on what is relevant to a particular business line 
and if other affiliates want access, the entity has to prove business 
use/need and request clearance by Wells Fargo Information Secu- 
rity. These firewalls, in turn, are examined by our Federal banking 
regulators. The Committee should also keep in mind that as we ac- 
quire other financial companies, we may elect to keep them oper- 
ating in their existing structures, so our so-called affiliate number 
fluctuates. 

Q.2. Last week we heard from both the FTC and the U.S. Secret 
Service that information sharing helps prevent identity theft. In 
Ms. Brill’s statement, she states that this practice likely facilitates 
identity theft. Mr. Baloun, does sharing information among affili- 
ates increase or help prevent identity theft? 

A.2. Yes, affiliate sharing does control fraud perpetrated against 
Wells Fargo businesses. Our tellers are our front line of defense in 
controlling fraud and can only do that because they have the nec- 
essary information in front of them. 
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In Omaha, Nebraska, Teller Sara Locke compared the out-of- 
State account information in her computer with the identity pro- 
vided by a customer in Omaha, and stopped her from fraudulently 
cashing a check for $2,700 drawn on a Wells Fargo California bank 
account. Locke noticed that the real accountholder’s birth date did 
not match the age of the person standing in front of her. The real 
accountholder was in her 70’s, while the person standing in front 
of the teller looked no more than 30. The police were contacted, 
and the information provided by the woman helped them uncover 
a nationwide fraud ring. 

RESPONSE TO WRITTEN QUESTIONS OF SENATOR JOHNSON 
FROM TERRY BALOUN 

Q.l. Professor Reidenberg has made some assertions in his testi- 
mony that variation in State laws has had little to no impact on 
the availability of financial services in those States. You run Wells 
Fargo in North Dakota, which had a high profile referendum on opt 
in versus opt out. Would you comment on what impact this ref- 
erendum has had on your ability to serve people in North Dakota. 
A.l. Wells Fargo’s experiences with the outcome of the North Da- 
kota referendum show that Wells Fargo customers do not get infor- 
mation about certain Wells Fargo products. That same customer 
may get information from another provider or may not receive as 
large a variety as individuals in other States. Conforming with 
Gramm-Leach-Bliley, the North Dakota legislature changed its opt 
in law to opt out with respect to information sharing with outside 
third parties for financial purposes. But this was reversed by a 
2002 referendum election to return to an opt in standard requiring 
banks to get customer approval before providing financial services 
offered by a third party financial services company. Wells Fargo ex- 
pects that the result will have an impact on North Dakota’s rural 
communities. To ensure compliance. Wells Fargo has, in effect, 
placed all the residents of North Dakota on a do-not-contact list re- 
garding insurance products and is not providing any unsolicited in- 
formation. Customers outside of North Dakota have opportunities 
for a broad array of financial products and North Dakota’s State 
action has the result of preventing rural access to that product list. 

Q.2. I think a lot of us here are surprised to learn how many affili- 
ates can be included in a corporate family. Would you please ex- 
plain why your companies are structured the way they are and how 
many affiliates actually have access to consumer information? For 
example, it is my understanding that while Bank of America has 
over 1,100 affiliates, only 20 or so of those affiliates actually deal 
with consumer information. 

A.2. Wells Fargo has roughly 800 legal entities — so-called affili- 
ates — ^but 38 are considered to be national businesses (per annual 
report) and roughly a quarter of the 800 number actually use con- 
sumer data. Moreover, Wells Fargo is structured so that data is 
available based on what is relevant to a particular business line 
and if other affiliates want access, the entity has to prove business 
use/need and request clearance by Wells Fargo information secu- 
rity. The Committee should also keep in mind that as we acquire 
other financial companies, we may elect to keep them operating in 
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their existing structures, so our so-called affiliate number fluc- 
tuates. 

Q.3. It has been noted today that information shared within an af- 
filiated structure does not constitute a consumer report and is 
therefore not protected by the FCRA with respect, for example, to 
adverse action notices and reinvestigation timeframes. Would you 
please describe how you might use internal credit information, and 
whether this lack of protection might adversely affect your cus- 
tomers? For example, how might you use experience information of 
a credit card customer if that customer applies for a mortgage 
through your mortgage affiliate? 

A.3. It is simply not true that information provided by affiliates is 
not subject to adverse action and reinvestigation protections. The 
FCRA Section 615(b)(2) requires that when adverse action is taken 
because of information provided by an affiliate, the consumer is en- 
titled to an adverse action notice that is substantially similar to 
that required when adverse action is taken based on information 
provided by a consumer reporting agency. In most cases, including 
the example given in the question, the information used in connec- 
tion with an application for new credit, will have been reflected in 
a billing statement provided to the customer by the institution, and 
subject to the protections of the Fair Credit Billing Act (FCBA), in- 
cluding the right to dispute information. Unlike the FCRA, when 
a dispute is lodged directly with the institution under the FCBA, 
the institution is required to not report the disputed amount as de- 
linquent to any consumer reporting agency until the reinvestiga- 
tion has been completed and the information verified. (Under the 
FCRA, the reporting institution must note that a dispute has been 
lodged, but it may continue to report the disputed information 
pending resolution of the dispute.) 

Q.4. What steps do you take with new customers to help them un- 
derstand their rights to opt out of information sharing among affili- 
ates? Do you do more than just send them the privacy notice? Are 
tellers, for example, trained in any particular manner to help cus- 
tomers understand their rights? 

A.4. All employees go through annual privacy training. Our Wells 
Fargo bankers that set up new accounts for customers are trained 
to provide privacy notices and help customers that have elected to 
opt out — if a customer would like to opt out, they are given options, 
including a toll-free number. In addition. Wells Fargo goes over 
and above current FCRA requirements by providing an annual op- 
portunity to opt out. 

Opting out of affiliate sharing is easy at most large financial in- 
stitutions. Wells Fargo, for example, provides an 800 number that 
customers can call to opt out (and register other privacy preference) 
in addition to a simple tear-off form attached to the privacy disclo- 
sures given to all new customers and annually to existing cus- 
tomers — which is over and above what the Fair Credit Reporting 
Act requires. 

Financial institutions maintain centralized customer information 
systems — which are the key to detecting and preventing identity 
theft — primarily to provide seamless service to our customers, and 
to inform customers about other products and services that we be- 
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lieve might be of interest to them. Merely exempting fraud preven- 
tion uses from restrictions on information sharing will not provide 
the incentive needed to develop and maintain such complex and ex- 
pensive systems. 

As I indicated in my statement, without affiliate sharing, Wells 
Fargo will be unable to provide service to bank customers across 
State lines, or service across legal entity lines (that is, paying mort- 
gage or credit card bills at bank branches, offer combined state- 
ments, and provide our business direct loans to small business 
owners.) 

Information is generally made available to affiliates by granting 
access to the centralized customer information system which 
contains primarily account-level information or, in some cases, to 
systems of record with more detailed transaction information. For 
example, employees who answer customer service telephone calls 
may need access to detailed transaction information in order to re- 
spond to questions about specific checking or credit card trans- 
actions. Access to all customer information, whether within the 
same legal entity or across affiliates is restricted on a “need to 
know” basis; employees of affiliates which do not provide consumer 
products and services would not have access to any information 
about any consumer customers. Extensive physical, technical and 
procedural safeguards are employed to protect customer informa- 
tion at all stages. 

Q.5. There seems to be some disagreement about whether affiliate 
sharing is more about benefits to the company or the consumer. 
What benefits specifically flow to the customer, and I do not mean 
getting marketing fliers that are often included in a credit card 
statement. 

A.5. With affiliate sharing of information. Wells Fargo mortgage 
has provided close to 200,000 new mortgages as a result of refer- 
rals from a Wells Fargo bank. Specifically, Wells Fargo can offer 
beneficial rates and streamlined services to mortgage customers. 
For example: 

• Wells Fargo mortgage can offer its existing mortgage customers 
beneficial rates and quick turnaround on refinancings. Mortgage 
can quickly gather needed data from all Wells Fargo businesses 
with which the customer may have a relationship. Process keeps 
Wells Fargo customers away from other predatory mortgage 
lenders that make it tough and costly to refinance. 

• Pack pricing: Wells Fargo regions offer new mortgage customers 
a $300 discount on closing costs if customer opens up a package 
relationship with Wells Fargo, which includes: Bank account, 
credit card, discounts on brokerage feesAVells Trade, and a free 
consultation with a financial consultant. 

• Customers who want to open a home equity line simultaneously 
with getting their mortgage only have to provide their informa- 
tion once because we are able to share their information across 
affiliates. 

Generally, Wells Fargo’s ability to compete against other compa- 
nies — “our secret sauce” — is to be able to find creditworthy cus- 
tomers in a population that would not appear creditworthy just on 
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credit bureau/credit score information alone — that is, our own expe- 
rience with the customer. 

This allows us to qualify more customers and to extend credit to 
those we otherwise in the absence of this internal information 
would have turned down. 

If we cannot aggregate our own customer experience info, our 
ability to identify good customers based on internally generated in- 
formation would be eliminated. Competitors who collect informa- 
tion about customers and operate in a single enterprise would not 
be impacted. 

Q.5. Do you have any data to share with the Committee on how 
information sharing has impacted your lending practices in tradi- 
tionally underserved communities? In particular, have you seen an 
impact on mortgage lending in underserved communities? 

A.5. The United States currently enjoys historically low interest 
rates on almost all credit products, and greater access to credit for 
all economic segments than has ever been true in the past. Long- 
term, the decline in consumer interest rates in the United States 
has been driven by three primary factors: 

• Better risk assessment. 

• National competition. 

• An active and efficient secondary market for consumer credit re- 
ceivables — especially mortgages. 

All three of these forces depend on accurate, complete, and con- 
sistent credit information on a nationwide basis, and thus would be 
endangered if different States had different laws on information 
sharing and credit reporting. In California, data on our mortgage 
market shows that 40 percent of new Hispanic Wells Fargo mort- 
gage customers became homeowners as a result of a Wells Fargo 
bank referring the customer to an affiliates Wells Fargo Home 
Mortgage office. 

Q.6. I am interested in something Mr. Prill has noted in his state- 
ment related to customer demand for mailings announcing sales 
and other promotions. Some people might view this as junk mail. 
Do you have any statistics anecdotes relating to how these pro- 
motional materials might be viewed? 

A.6. In all direct marketing, the response rate increases when you 
are able to target the message more closely to consumers who are 
likely to be interested in the product. When interest rates on mort- 
gages are low, we know our customers appreciate hearing from us, 
especially if we are able to offer them a preapproved loan or a 
streamlined process for refinancing their loans as a result of the re- 
lationship they have with us. 

Q.7. Do you have statistics to opt out rates among customers that 
might show that customers understand their rights? Are opt out 
rates the same among all customer groups? 

A.7. Wells Fargo customer opt out rates have remained fairly low 
(about 5 percent) for over 5 years, despite annual disclosures and 
extensive media attention to the subject. When Wells Fargo con- 
ducted research among customers and noncustomers to assess the 
readability of privacy disclosures, we learned that the respondents 
understood the disclosures easily when they took the time to read 
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them, but most stated that they had not opted out and did not plan 
to because they trusted their banks. 

Wells Fargo’s privacy policy goes beyond the GLBA in that we 
offer our customers separate choices to opt out of internal and ex- 
ternal sharing, even though the only external sharing we do is with 
other financial institutions as permitted by the GLBA. The number 
of customers who opt out of external sharing is more than double 
the number who opt out of internal sharing only, indicating that 
there is a clear distinction between the two types of sharing and 
that our customers feel significantly more comfortable with inter- 
nal sharing than with external sharing. 

Not all customers have a high level of concern about opting out, 
and even fewer opt out from sharing within a company with which 
they have a relationship. National consumer research indicates 
that, in general, about 26 percent of Americans have been identi- 
fied as “privacy fundamentalists” (Privacy & American Business/ 
Harris Poll, March 2003). Ten percent are classified as “uncon- 
cerned” and 64 percent are labeled “pragmatists.” These statistics 
do not necessarily pertain to established business relationships, 
where the number of people concerned enough to take action and 
opt out would be expected to be much lower. Therefore, if the uni- 
verse of consumers who have expressed concerns about privacy in 
any venue is 26 percent, and that number is significantly reduced 
to eliminate those consumers who are less concerned or uncon- 
cerned about companies with which they have an established busi- 
ness relationship, then the rate of opt outs experienced within the 
financial services industry seems reasonable and appropriate. 

RESPONSE TO WRITTEN QUESTIONS OF SENATOR SHELBY 
FROM MARTIN WONG 

Q.l. What level of understanding does the average consumer have 
with respect to affiliate sharing? 

A.l. The average consumer has many opportunities, from life expe- 
rience and now from Fair Credit Reporting Act (FCRA) and 
Gramm-Leach-Bliley Act (GLB) notices, to become aware that fi- 
nancial information may be shared with affiliates for customer 
service, operational, and marketing purposes. Consumers expect 
prompt and efficient delivery of products or services from their fi- 
nancial institution and seem to understand that information must 
be shared among affiliates to meet those needs. Consumers also 
have some awareness that many U.S. financial service companies, 
for historical reasons, have a large number of affiliates. Consumers 
may become aware of this when they move between States and 
need to change homeowner or auto policies, or when they must 
take additional steps in order to make bank deposits from outside 
their home State. 

Recognizing that customers want seamless service, affiliate shar- 
ing programs are focused on enabling a group of affiliates to serve 
their customers in an integrated, cohesive fashion rather than 
interacting with customers in a seemingly disjointed and customer- 
unfriendly way. While some of the affiliate sharing is obvious to 
consumers, other affiliate sharing is not. For example, if customers 
access all of their accounts through a combined statement, transfer 
funds among accounts at different affiliates through a single ATM 
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transaction, or manage their money through a consolidated web- 
site, they understand — and want — information to be shared among 
affiliates. The customer may not be aware of all the legal vehicles 
that operate jointly to provide retail banking products to individual 
depositors and borrowers. For example, the Citibank retail banking 
business in the United States operates under 10 separate charters. 
Nor may customers feel a need to know that each of these entities 
may have a number of subsidiaries and affiliates that provide serv- 
icing for the loans or back office systems support, hold foreclosed 
property taken in satisfaction of debts, or act as agent in the sale 
of insurance to bank customers. 

However, customers generally expect these affiliates to work to- 
gether and share information so that a customer from a Con- 
necticut branch (Citibank, F.S.B.) can receive the service he or she 
expects when coming to a New York City branch (Citibank, N.A.). 
This service is based on the ability of the customer service rep- 
resentative to access the customer’s deposit accounts and out- 
standing lines of credit on a screen in the branch of the affiliate, 
to validate the customer’s identity, and to have efficient procedures 
for processing the request. 

Q.2. Does the number of affiliates a firm has affect this under- 
standing? 

A.2. Customers who deal with Citigroup are aware of the fact that 
we are a global brand with many affiliated businesses. Citigroup 
promotes our ability to offer comprehensive financial services to 
customers through our affiliated business lines and believes that 
many customers choose to do business with us for that reason. Cus- 
tomer understanding is less a function of the number of affiliates 
a firm has and more a function of whether or not the affiliates 
interact directly with customers. 

Q.3. What about situations where the affiliates are engaged in en- 
tirely different lines of business? Does it matter that a person rec- 
ognizes that they have a relationship with a bank but may not 
know that the bank also owns a retail securities brokerage oper- 
ation or a direct mail operation where this information would be 
used and other things? 

A.3. Citigroup, as a financial holding company, only has financial 
affiliates. Citigroup’s reputation is enhanced by the affiliates we 
have assembled to serve customers with banking, insurance, and 
securities products. Many of our customers have chosen a Citigroup 
company due to the breadth and sophistication of our product offer- 
ings. As part of each brand, we identify the business as a “member 
of Citigroup.” Moreover, GLB notices are required to make cus- 
tomers aware that affiliates may be in these other business lines. 

We understand that there are some customers who may not want 
to be solicited for products by other Citigroup companies. For that 
reason, Citigroup provides our customers with an opportunity to 
opt out so that a business does not provide that customer’s name 
for solicitations to other Citigroup business lines. This opt out op- 
portunity goes significantly beyond the FCRA and GLB opt out 
choices. We and other institutions offer these and other choices to 
customers as a matter of responding to customer needs. 
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Q.4. How important is a firm’s brand to consumers in establishing 
their expectations with respect to the kind of relationship they 
have with a company? 

A.4. Our research on our GLB privacy notice indicates that having 
a notice in line with consumer’s perception of the brand is very im- 
portant. For example, consumers know Citigroup as a large global 
company with many financial affiliates. Citigroup is known as a 
leader in marketing, as well as in information security and con- 
sumer choices. Consumers have found our notice to be in line with 
this perception. Citigroup may even hurt our reputation and stock 
price if we said that the company no longer believed in cross-sell- 
ing. On the other hand, an institution with fewer cross-sell oppor- 
tunities may use such a market position as a competitive difference 
for its own particular segment of consumers. 

Citigroup has found that brand names are important to con- 
sumers and serve as a shorthand way by which consumers can 
identify companies from whom they have received good or bad serv- 
ice in the past. This encourages them to seek those companies for 
services in the future, or to avoid them, as appropriate. 

Because of this, Citigroup makes a serious effort to ensure that 
our brand is well known to consumers, and that the attitude that 
consumers adopt when they see this brand is a positive one. From 
the consumer perspective, a company with one of the Citigroup 
brands is expected to perform the service the consumer wants re- 
gardless of what legal entities may be needed to provide that per- 
formance. To the consumer, it is the quality of the service that is 
crucial, not the numbers or kinds of affiliates involved in delivery 
of the product. 

Cenerally, it really does not make a difference to a customer with 
a Citibank credit card that his or her bill is processed in a legal 
entity designed to meet State law requirements in any of a dozen 
different States, as long as the company has proper controls for pri- 
vacy, security, and quality. This is also true for nonaffiliated third 
parties who are working strictly under the company’s control. 

We also find that customers expect certain performances by 
Citigroup once a customer relationship has been established. For 
example, customers expect that Citigroup would recognize them as 
a customer in whatever part of Citigroup that they enter, or that 
Citigroup can do so quickly once the consumers identify themselves 
as a customer. 

Q.5. How important is that brand? 

A.5. The reputation of the brand is extremely important to any 
company. That is why “reputation risk” is a key regulatory concern 
within financial services. This, more than specific laws and regula- 
tions, may drive a company’s privacy practices within the financial 
services sector, which usually go well beyond the law. In the case 
of Citigroup, we put a major stake in the ground with our 
Citigroup Privacy Promise for Consumers as an element of our 
brand. 

Regardless of the numbers of affiliated entities or the businesses 
in which they engage, the consumer will remember the brand. If 
we provide good service in any of the businesses, the customer may 
be more likely to consider purchasing products of another Citigroup 
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business. If we provide poor services, the customer will be less in- 
clined to use the service of that entity or any other institution that 
carries our brand. Customers may even cancel products that they 
have with other affiliates if they are disappointed with one of them. 

Q.6. Should there be safeguards, or best practices for sharing infor- 
mation within affiliates? 

A.6. In addition to the restrictions on affiliate sharing contained in 
the FCRA, there are many other laws and regulations, as well as 
industry-wide and internal company safeguards and best practices, 
that govern information sharing for financial firms. We feel that it 
is most appropriate for specific standards to be adopted at the indi- 
vidual company level since this provides the greatest ability to 
respond to external threats that can change rapidly. If laws or reg- 
ulations are required, these will be most useful to consumers if 
they are directed to specifically identified harms. 

From a sharing perspective, the most important provisions may 
fall under the information security requirements now required 
under GLB for a very broad set of financial services companies. For 
banks, these require written information security safeguards that 
are formalized and included as part of the regulatory examination 
process. These apply within business units and departments, as 
well as across third parties and affiliates. 

Regulators are also able to provide guidance through broad rep- 
utation risk and safety and soundness requirements. 

Q.7. While called “affiliate” sharing provisions, these provisions ac- 
tually allow companies to share information with entities that are 
outside their affiliates structures, don’t they? Why is this necessary 
and does this make sense? 

A.7. We understand that this question relates to the FCRA provi- 
sion concerning the sharing of transaction and experiential infor- 
mation. However, GLB provides customers an opt out right for any 
sharing of such information with third parties by any entity that 
provides services that are “financial in nature.” Our understanding 
is that this term covers any provider financial services, whether or 
not they hold a specialized license or charter to engage in banking, 
securities, insurance, consumer finance, or other financial activity. 
Thus, we are not sure that the “loophole” suggested by this ques- 
tion actually exists. In any event, if such a “loophole” does exist, 
it is not one that Citigroup or any other entity covered by GLB 
could use. 

Q.8. Do consumers have different concerns with respect to affiliate 
sharing versus third party sharing? 

A.8. We do not have any special information on this. We think the 
answer is probably “no” when third parties are acting as our agents 
and marketing our own financial products. We think the answer 
may be “yes” when third parties are not acting as our agents and 
are marketing their own products, but this is likely to depend on 
whether the third party has appropriate information security 
standards. 

Q.9. Should there be greater control over sharing information out- 
side of an affiliate structure than within? In other words, should 
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this provision be limited so that the only type of information shar- 
ing permitted is sharing within affiliated entities? 

A.9. For financial services companies, there is already more control 
over third party sharing than there is for affiliate sharing. Under 
GLB, the notice and opt out choice covers more data and more pur- 
poses — even the fact that a person is a customer is included. In the 
event of an opt out, the ability to share transaction and experience 
data with third parties becomes very limited. There is also a ban 
on sharing credit bureau reports with third parties. Most of the 
sharing of customer information in which Citigroup engages is with 
affiliates. There are many instances, however, in which Citigroup 
has found that utilizing third parties to assist us in meeting cer- 
tain customer requests or providing certain services provides a bet- 
ter and less expensive product for the customer. These third parties 
have legally binding contractual commitments to Citigroup to per- 
form these services with the same confidentiality and security that 
Citigroup provides to our customers. We monitor these companies 
on their compliance with these provisions. 

Q.IO. Do financial institutions make underwriting decisions with- 
out using credit reports? 

A.IO. In making decisions about whether to extend credit, we al- 
ways look for a credit report when providing unsecured loans or 
credit lines since this offers the most timely, consistent, and full 
view of the consumer. 

However, many consumers with a “thin file” or no credit report 
could be expected to perform well. To be fair to these consumers, 
Citigroup and other companies establish special programs to make 
credit available. The obvious case is a client who has done a good 
job of managing a checking account over a period of time. Another 
customer may meet other application criteria that we can confirm 
such as owning a home or having a steady job. This may qualify 
the customer for an appropriate product, perhaps starting with a 
small value overdraft credit line. 

There are also relatively rare cases in which we do not use a 
credit report, such as when executives from certain other countries 
are relocated to work in the United States for some period of time. 
Our retail bank branch may make arrangements with our credit 
card company to provide credit cards for these executives, since a 
credit card has become a necessity in the United States for making 
reservations, renting a car, or engaging in other consumer trans- 
actions. As a matter of interest, this, like any other interaffiliate 
agreement within a bank holding company, is subject to arms 
length negotiations between affiliates. 

Q.ll. There are a range of sharing activities that you are per- 
mitted to engage in under the law. Have any of your firms decided 
NOT take advantage of the full range these sharing activities — are 
there things you could do but do not do, and if so, why don’t you 
do these things? 

A.ll. Citigroup and other companies focus their limited resources 
on items of value to their consumers and efficiencies to the com- 
pany. This means that we share very little of what we are per- 
mitted to share for reasons of business efficiency, as well as for 
information security reasons. “Need-to-know” procedures and simi- 
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lar rules cause companies like Citigroup to require a good reason 
for sharing before allowing it to happen. 

Customer relationships, including information about these cus- 
tomers, are often a company’s most important asset. Even within 
a large institution, each broker or banker is likely to be very pro- 
tective of his or her clients since it may have taken years to build 
up the current level of trust. 

In terms of efficiency, when designing screens that display infor- 
mation to our staff, it is difficult enough to clearly show a banker 
or broker the volume of information they need to see without hav- 
ing screens cluttered with information from other internal or exter- 
nal sources that are not relevant to their business. 

In terms of marketing, a business that is focused on a particular 
portion of the population is not likely to have any interest in infor- 
mation from affiliates about consumers who are not part of that 
population because of the increased costs that follow processing of 
additional information. 

In our credit card business, we pull credit reports very regularly 
to monitor open-ended accounts. While we could reduce costs by 
pulling one report for a customer and applying it to all of that cus- 
tomer’s accounts, we actually pull a report for each separate ac- 
count. This is because the value of the credit bureau information 
starts dropping almost instantly after it is obtained, since the con- 
sumer may have engaged in activity that compromises the informa- 
tion that is on the report. The lost value from a short delay would 
be greater than the cost of pulling separate reports for these addi- 
tional accounts. This is the case within the credit card affiliate, as 
well as across affiliates. 

RESPONSE TO WRITTEN QUESTIONS OF SENATOR RUNNING 
FROM MARTIN WONG 

Q.l. Are there simple ways to make the opt out notice clearer to 
the consumer without having to send out the long and drawn out 
privacy notices. I think that if it was clearer, whether that means 
bold print, a larger check off box, or a simple and precise expla- 
nation, it would eliminate some of the apprehension some have. Do 
you agree or disagree? 

A.I. Citigroup agrees. However, we would like to note that we have 
received very few complaints from our customers about our privacy 
notices. Clearly, not all customers have difficulties understanding 
notices, because we have a fair amount of customer inquiries and 
opt outs, which shows that customers are reading and reacting to 
our notices. 

We also would like to note that before a company can share in- 
formation among affiliates or with nonaffiliated third parties, a 
company must provide the consumer with a clear and conspicuous 
disclosure and opportunity to opt out. Citigroup, like other compa- 
nies, takes this clear and conspicuous requirement seriously and 
has expended significant time and effort in making our own privacy 
choices clear and easy to respond to. For example, on our credit 
card applications, we currently have the selection for affiliate shar- 
ing in bold type next to the signature line. This is prime space on 
the brochure and is quite prominent. When the consumer chooses 
to open a credit card account by phone, we make the same clear 
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choices available in our scripts. We also make the FCRA choice 
very clear in our privacy brochures that we provide at account 
opening and once per year. 

That said, we have been working with several industry groups to 
come up with ways to improve the notices to make them more clear 
and concise. This is an issue that should be discussed more fully 
in the future outside of the context of FCRA reauthorization. For 
example, there may be a benefit in having a consistent framework 
for notices that are used by both financial and nonfinancial compa- 
nies. This may promote customer understanding of these notices 
and their use of these disclosures in deciding whether or not to 
open a particular account or to provide particular information. 

Q.2. What unintended consequences do you foresee for some of the 
proposals that would change the current affiliate sharing status 
quo? 

A.2. If a number of States would adopt opt in laws or require- 
ments, it would increase the complexity of the notice and the dif- 
ficulty of obtaining customer choice. The unintended consequence 
might well be an effective ban on information sharing. 

Another unintended consequence is likely to be a coerced reduc- 
tion in the number of their affiliates simply to protect current 
methods of doing business. While this would have virtually no con- 
sumer benefits, it could reduce positive benefits that companies get 
from their current structure, as well as benefits that local commu- 
nities may receive from locally organized affiliates. 

Those who lived through the interstate banking era may well re- 
member the difficulty of managing a central back office so that 
calls from a particular area code were answered by a person who 
reported to the particular business unit in that State. The rules in 
effect at that time may have required the call to be transferred if 
the customer actually held accounts in a different State. Even then, 
there was often the need to ask the customer to separately call 
back other affiliates if there were multiple accounts. While some of 
this still occurs, it is generally something that customers would 
prefer to avoid. 

Another likely State-mandated change would be longer and more 
complex privacy notices or separate notices to customers in dif- 
ferent States. Currently, for example, California requires a dif- 
ferent notice to insurance customers. States are likely to insist on 
differing information in the disclosure. 

If these changes reduced the quality or consistency of data, these 
would be likely to impact many different types of models that de- 
pend upon the data, whether fraud scores or credit scores. Compa- 
nies may respond by tightening lending or increasing borrowing 
costs. There are, as yet, no good opt in models that are likely to 
work for the affiliate structure that currently exists for U.S. finan- 
cial services or for the large portfolios of existing customers that 
most established financial service companies have. Changes in 
State or Federal laws at this time could easily stop the develop- 
ments of certain products. Most laws and regulations that have 
worked well have been adopted only after the market has ceased 
its experimentations and settled upon a process or a product that 
works. An example where that was not done was the short time 
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frame GLB provided for companies to adopt opt out systems. Many 
companies simply abandoned third party sharing after passage of 
GLB because they were unable to meet those times frames, with 
the resulting detrimental impact on their customers and upon the 
companies’ competitive position. 

Q.3. What are some of the difficulties financial service companies 
might have in marketing to a community where there are multiple 
privacy standards? 

A.3. In 2003, we have seen dozens of bills introduced in the States 
that would vary from the national standards established by the 
FCRA. The cost to comply with each variation would be significant 
for companies that operate nationally. Multiple privacy standards 
essentially destroy the economies of scale associated with national 
markets, which means that the benefit of these economies of scale 
cannot be passed on to consumers. Depending upon the significance 
of the market in a State, some companies might not find it eco- 
nomically feasible to market in some States with requirements too 
different or stringent. Additionally, we have seen an increase in 
municipalities and counties that seek to adopt their own privacy 
standards, making it even more difficult to market to consumers 
and serve our customers. Multiple standards also degrade the accu- 
racy and compatibility of credit reports, which would raise the price 
of credit and limit credit availability. 

Q.4. Do you think that a company that has stringent privacy prac- 
tices (the good guys) would open itself up to unnecessary litigation 
if it has to adhere to multiple privacy standards? 

A.4. Yes. Litigation is often driven by the complexity of well-inten- 
tioned legal requirements. For example, we often face requirements 
from a statute or regulation to delete particular records after a 
short period of time. Another statute or regulation may require us 
to retain those records for a longer period of time. In another case, 
one regulator may want to give an advantage to local companies 
that do most of their business through branches, while another reg- 
ulator may be trying to entice diversified national companies to 
enter the market. A single account may be under two different sets 
of contradictory regulations if one regulator focuses on where the 
company has its charter and another on where the customer lives. 
This can be further complicated as lifestyles change over time and 
more and more customers have multiple primary addresses, which 
change regularly throughout the year. 

If companies need to communicate multiple policies, these poli- 
cies are more likely to be misunderstood by employees and cus- 
tomers, and the risk of failing to comply is exacerbated. This is 
especially true in the case of disclosure requirements where the no- 
tices may be complicated by a need to include differing require- 
ments and to use different model notices. The credit card billing 
disclosures of 25 years ago included multiple footnotes with the dif- 
fering requirements of each State and would be criticized today as 
an ineffective disclosure tool. This is a reasonable model of where 
unfettered State action could take us in the privacy area. 

We have already seen in the case of privacy that even localities, 
such as Daly City and the unincorporated portions of Santa Clara 
County, have imposed local requirements. Companies whose prac- 
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tices are universally recognized as “best” practices may be caught 
off guard by variations in local requirements that result in expen- 
sive or impossible choices. 

Q.5. Do you think that a company that does business in an area 
that institutes multiple privacy standards will choose to stop doing 
business in that area? 

A.5. In our experience in States like Vermont, most of our busi- 
nesses have continued to do business in the State but have opted 
customers out of information sharing which, in the process, has 
eliminated many choices for Vermont customers that we provide to 
customers in other States. At some point, this may result in un- 
profitable or unsatisfying relationships for us or for the customer. 
These could make companies consider terminating business in the 
area and prevent new competition from entering. 

Q.6. How many consumers actually opt out of information sharing 
with affiliates? 

A.6. Among Citigroup companies, the range of cumulative opt outs 
over time for affiliate sharing varies from percentages in the low 
single digits to the mid-30’s. These differences are driven by many 
factors. The higher opt outs are generally found where the opt out 
has been offered for a longer period of time and the relationship 
is remote rather than face-to-face. 

RESPONSE TO WRITTEN QUESTIONS OF SENATOR JOHNSON 
FROM MARTIN WONG 

Q.l. I think a lot of us here are surprised to learn how many affili- 
ates can be included in a corporate family. Would you please ex- 
plain why your companies are structured the way they are, and 
how many affiliates actually have access to consumer information? 
For example, it is my understanding that while Bank of America 
has over 1,100 affiliates, only 20 or so of those affiliates actually 
deal with consumer information. 

A.l. Citigroup has never felt that consumers care about the num- 
ber or kinds of affiliations that exist in the Citigroup corporate 
family, nor do they care why they exist. They want good service 
provided in a timely manner, and if we can provide that, we feel 
our customers will be satisfied. 

Citigroup is a financial holding company comprised of approxi- 
mately 1,900 affiliates, more than half of which are incorporated in 
the 100 foreign countries in which Citigroup operates. The majority 
of these affiliates are established or retained for legal, regulatory, 
or tax purposes and the number includes entities that are histor- 
ical vestiges of outdated banking laws or recent mergers. Many af- 
filiates do business only with Government or corporate entities or 
exist solely to house certain assets. 

Only a small percentage of these entities actually transact busi- 
ness with individual consumers, and much of the number of legal 
vehicles is the result of State licensing requirements in such lines 
of business as insurance and consumer finance companies. More- 
over, Citigroup is limited by GLB to the provision of financial serv- 
ices in one of three lines of business — banking, insurance, and 
securities. For the customers who conduct business with us, our af- 
filiate structure is invisible and irrelevant. Therefore, when viewed 
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from the customer’s perspective, Citigroup is a single provider of fi- 
nancial services. 

Q.2. It has been noted today that information shared within an af- 
filiated structure does not constitute a “consumer report” and is 
therefore not protected by the FCRA with respect, for example, to 
adverse action notices and reinvestigation timeframes. Would you 
please describe how you might use internal credit information, and 
whether this lack of protection might adversely affect your cus- 
tomers? For example, how might you use experience information of 
a credit card customer if that customer applies for a mortgage 
through your mortgage affiliate? 

A.2. First, it should be noted that where Regulation B and the 
Equal Credit Opportunity Act (ECOA) apply, we are required to 
provide an adverse action notice whenever we take an adverse 
action. This notice must include the principal reasons for why this 
action was taken. If the basis for the adverse action came from in- 
formation provided by an affiliate, the customer would be required 
to receive written notice in accordance with Section 615(b)(2) of the 
ECRA. On the rare occasion that customers want to dispute infor- 
mation provided by an affiliate, they have the opportunity to con- 
tact the affiliate directly to resolve the dispute. 

It also should be noted that a consumer may have more protec- 
tion in the sharing of consumer reports among affiliates than they 
do with credit reporting agencies, since they can opt out of the 
sharing among affiliates, at least to the extent that the information 
is other than internal experience information. And to the extent 
that internal experience information is involved, this is the same 
information routinely shared by different departments within a sin- 
gle financial institution. 

As an example of the use of internal experience information, if 
a customer applies for a mortgage through our mortgage affiliate, 
we always pull one or more reports from the credit reporting agen- 
cies. If the application is by phone, we may use recent “application 
information” from some affiliates to complete the application or 
verify the information provided by the customer to reduce the time 
the customer may need to spend on the phone. 

Q.3. What steps do you take with new customers to help them un- 
derstand their right to opt out of information sharing among affili- 
ates? Do you do more than just send them the privacy notices? Are 
tellers, for example, trained in any particular manner to help cus- 
tomers understand their lights? 

A.3. Discussion of the affiliate opt out choice is a required part of 
the account opening process in our Citibank retail branches and is 
included in account opening scripts when credit card accounts are 
opened on the phone. We use Citibank financial consultants rather 
than tellers to explain this to customers. Most of our businesses 
have training and scripts for phone customer service staff who may 
get these questions. In other cases, the customer may be referred 
to their account officer, agent, or broker for an explanation. 

Citigroup spends a substantial amount of time and money, in- 
cluding on consumer focus groups to test draft notices, to ensure 
that customers do, in fact, see and understand their opt out rights. 
In some businesses, this has led us to a prominent display of the 
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“opt out” box rather than a description of rights. The fact that sig- 
nificant numbers of our customers do opt out provides good evi- 
dence that customers are aware of their choices. 

As with other disclosures, Citigroup’s success as a financial serv- 
ices company will be determined, in great part, by whether or not 
our customers trust us. If we are not trusted, we will lose cus- 
tomers, so we make every effort to make sure that customers un- 
derstand all of our communications with them. 

Q.4. There seems to be some disagreement about whether affiliate 
sharing is more about benefits to the company or the consumer. 
What benefits specifically flow to the customer, and I do not mean 
getting marketing fliers that are often included in a credit card 
statement. 

A.4. Overall, consumers who value convenience and efficiency get 
tremendous benefits when their financial institutions can share 
transaction and experience information across affiliates. For exam- 
ple, customers can see all of their information on one statement, 
access all of their accounts at one time at the ATM or online, and 
get lower “combined balance” fees. Customers may be able to add 
new accounts without filling out forms and may easily transfer 
money between brokerage, banking, and credit accounts to mini- 
mize interest paid or as their needs or the market changes. As cus- 
tomers move from one State to another, they are able to keep their 
same financial relationship rather than closing all accounts and 
starting over again. 

On an operational level, institutions, like Citigroup, can use affil- 
iate sharing to place holds against savings accounts or credit lines 
rather than bounce checks, saving the customer embarrassment 
and fees. The institution may be able to update phone numbers and 
addresses of multiple accounts at the same time. The institution 
also may be able to validate the customer across accounts using 
one card and one password for the consumer to remember. 

These efficiencies may also save the institution money, some or 
all of which may flow back to the customer. The ability to share 
information also increases competition since the barriers to entry 
are reduced. This can broaden offerings and offer alternatives for 
better service or lower prices. 

In terms of credit granting, one useful example may be a cus- 
tomer who picks up a credit card brochure in a convenient location 
and applies for the product offered. While the customer may have 
an immediate need for credit, he or she may apply for a product 
that is not appropriate to that customer’s qualifications or needs. 
If, on the application, the customer does not opt out from affiliate 
sharing, the financial institution may be able to provide a better 
offer of credit without asking the customer to fill in a new applica- 
tion and without adding another enquiry to the customer’s credit 
report. This may get customers the credit they need quickly and 
put them on the path of building a good credit rating. At Citigroup 
and at many other institutions, these different credit products are 
provided by different affiliates. 

Consumers also benefit from being able to apply for multiple 
credit products at the same time — with one application and one 
enquiry at the credit bureau. This may be a home equity line of 
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credit or a credit card opened in conjunction with obtaining a mort- 
gage. It also may be a credit card and an overdraft credit product 
included in the sales process when a customer opens a new check- 
ing account. These products are provided by different affiliates at 
Citigroup. The customer saves time, has fewer “enquiries” at the 
credit bureau, and gets a set of products that better meets his or 
her needs. 

Financial planning and awareness is made easier and more com- 
plete with an account opening procedure that looks at needs across 
deposit products, credit products, insurance, and securities to de- 
velop a consolidated financial plan. In the same way, periodic state- 
ments that include information about the current status of all of 
the products and services provided makes it easier for customers 
to see how they are doing. Shifting funds between various accounts 
and services from anywhere in the world as the customer deter- 
mines would be nearly impossible without affiliate sharing. 

Q.5. Do you have any data you can share with the Committee on 
how information sharing has impacted your lending practices in 
traditionally underserved communities? In particular, have you 
seen an impact on mortgage lending in undeserved communities? 
A.5. To the degree that the underserved market is characterized by 
more frequent moves and thinner credit reports, the more accurate 
information we obtain, including information on relationships with 
affiliated companies, the more likely we are to be able to give un- 
derwriting approval. 

The Committee received much information in the recent hearings 
on how the various FCRA provisions, including affiliate sharing, re- 
duce the cost of credit. Affiliate sharing allows us and other compa- 
nies to provide lower limit credit cards and credit lines that can 
pull underserved consumers into the market. It should be noted 
that even the cost of a privacy brochure could be the difference be- 
tween a small profit and a small loss on products that generate low 
returns. Requirements that lead to longer, more complex, or dif- 
fering State notices may raise the break-even point. 

We also have programs that allow us to provide offers of credit 
to applicants who have applied for an inappropriate product. For 
example, someone may have applied for a premium credit card 
when all they want is a loan or a low limit credit line. We can offer 
applicants who have not opted out of affiliate sharing a product 
that they qualify for. This may start them on the path to building 
a solid credit history so that they can qualify, over time, for that 
premium product. 

Q.6. I am interested in something Mr. Prill has noted in his testi- 
mony related to customer demand for mailings announcing sales 
and other promotions. Some people might view this as junk mail. 
Do you have any statistics or anecdotes relating to how these pro- 
motional materials might be viewed? 

A.6. Response rates are, indeed, low even for true zero percent 
credit offers that could save a consumer a significant amount of 
money. Ideally, companies could better use information to reduce 
this mail volume by better identifying consumers at the precise 
times that they are ready to buy. It often takes a number of mail- 
ings to get a consumer to take action, even where the offer involves 
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a product or service in which they have significant interest. There- 
fore, simple lack of action does not make this “junk mail.” 

Companies make a significant effort to reduce the unnecessary 
volume of general solicitations through the mail. This could change 
dramatically if there were a reduction in the ability to share infor- 
mation with affiliates. For example, a credit card company may 
currently suppress mailings about brokerage accounts for their sis- 
ter company to customers who already have such an account. Con- 
sumers appear to be very annoyed to see their company wasting 
money by sending offers for things they already have. 

Q.7. Do you have statistics relating to opt out rates customers that 
might show that customers understand their rights? Are opt out 
rates the same among all customer groups? 

A.7. Some of our Citigroup businesses have unique experience be- 
cause they have had marketing opt outs in place for more than 15 
years. This has been in the form of an annual notice and opt out 
form sent to credit card customers providing a method to opt out 
from promotional phone calls or mail. While the response to a par- 
ticular notice may be low, this accumulates, over time, to a signifi- 
cant portion of the portfolio. 

In the case of Citigroup’s opt out for information sharing across 
affiliates and third parties, the wide variations in opt out rates for 
different Citigroup affiliates show that customers are aware of 
their rights and take an action that is appropriate to the relation- 
ship with the company. Among Citigroup companies, the range of 
cumulative opt outs over time for affiliate sharing varied from per- 
centages in the low single digits to the mid-30’s. These differences 
are driven by many factors. The higher opt outs are generally 
found where the opt out has been offered for a longer period of time 
and the relationship is remote rather than face-to-face. 

RESPONSE TO WRITTEN QUESTIONS OF SENATOR DOLE 
FROM MARTIN WONG 

Q.l. In Ms. Brill’s statement she mentioned that Vermont law does 
not allow for affiliate sharing except for “transactions or experi- 
ences.” Can you tell me how this affects the service you provide to 
your customers in Vermont? Do your institutions actively seek cus- 
tomers in Vermont? 

A.l. The relevant regulations in Vermont only became applicable 
to Citigroup and other national lenders in 2001. The response of 
Citigroup and other national creditors to these regulations has 
been to automatically opt out all Vermont customers from pro- 
grams that would require affiliate sharing or third party sharing, 
because the cost of an opt in regime is prohibitive. Thus, the new 
regulations, rather than enhancing the privacy choices of Vermont 
customers, have, in fact, ended up limiting their choices. 

Q.2. Ms. Brill mentions that despite extensive regulation in this 
area by Vermont and several other States, the economies have not 
been adversely affected. Indeed, Vermont consumers face some of 
the most favorable conditions for loan rates in the country. Can you 
explain why the restrictive laws in Vermont have not resulted in 
higher loan rates? 
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A.2. The new Vermont regulations have only heen in place for 
about 16 months, so it is too early to draw any conclusions about 
the long-term effect of the change. From our perspective, as we 
have said, we do not provide offers to Vermont customers that re- 
quire affiliate sharing. Therefore, Vermont consumers have fewer 
choices available to them. As for the loan rates that Vermont resi- 
dents are paying, it appears likely that Vermont residents have so 
far continued to enjoy the benefits of a national uniform credit 
market. However, if every State made significant and inconsistent 
changes to the way this national market functioned, it is likely that 
none of the citizens of the U.S. could enjoy the benefits of a na- 
tional uniform credit market. 

Q.3. Some of my colleagues have made the point that some banks 
have thousands of affiliates, Ms. Prill also lists the number of affili- 
ates for KeyCorp and Citigroup in her statement. Can you explain 
why this is and how many of these affiliates actually deal in cus- 
tomer information? 

A.3. Citigroup has never felt that customers care about the number 
or kinds of affiliations that exist in the Citigroup corporate family, 
nor do they care why they exist. They want good service provided 
in a timely manner, and if we can provide that, we feel our cus- 
tomers will be satisfied. 

Citigroup is a financial holding company comprised of approxi- 
mately 1,900 affiliates operating in more than 100 companies. Of 
those subsidiaries, fewer than 50 percent operate in the United 
States. The majority of these affiliates are established or retained 
for legal, regulatory, or tax purposes and the number includes enti- 
ties that are historical vestiges of outdated banking laws or recent 
mergers. Many affiliates do business only with Government or cor- 
porate entities or exist solely to house certain assets. 

Only a small number of these entities actually transact business 
with individual consumers, and all of them are limited by GLB to 
the provision of financial services in one of three lines of business — 
banking, insurance, and securities. For the customers who conduct 
business with us, our affiliate structure is invisible and irrelevant. 
Therefore, when viewed from the customer’s perspective, Citigroup 
is a single provider of financial services. 
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June 24, 2003 

Senator Richard Shelby 

Chairman. Senate Committee on Banking, 

Housing, and Urban Affairs 
110 Hart Senate Office Building 
Washington, DC 20510 

Senator Paul Sarbanes 

Ranking Member, Senate Committee on Banking, 

Housing, and Urban Affairs 
309 Hart Senate Office Building 
Washington, DC, 20510 

RE: Senate Banking Committee Hearing on Affiliate Sharing 

Practices and Their Relationship to the Fair Credit Reporting Act 

Dear Chairman Shelby and Ranking Member Sarbanes: 

The Electronic Privacy Information Center (EPIC) submits this letter for inclusion in the 
June 26 , 2003 hearing record for the Senate Committee on Banking hearing on "Affiliate 
Sharing Practices and Their Relationship to the Fair Credit Reporting Act." EPIC is a not- 
for-profit research center based in Washington, D.C. It was established in 1 994 to focus 
public attention on emerging civil liberties issues and to protect privacy, the First 
Amendment, and constitutional values. We appreciate the Committee's attention to 
affiliate sharing and its civil liberties implications. 

We write to call your attention to loopholes in the Federal Credit Reporting Act (FCRA) 
that allow financial institutions to side-step privacy protections. In particular, financial 
institutions are allowed to share the personal information of their customers with third- 
parties and affiliates, placing the burden upon the customer to opt-out of such sharing. 
Even if the individual opts-out, the institution can nevertheless share an individual’s 
personal information with affiliates. Given the large number of affiliates some holding 
companies have, the practice of affiliate sharing effectively neutralizes the privacy 
protections built-in to the FCRA. As a solution, we propose that the individual control the 
dissemination of their information through an opt-in requirement for the sharing of all 
information, even in situations where companies wish to share information with affiliates 
and joint marketers. 

1. Weak protections against affiliate sharing place heavy burdens on 
individuals and law enforcement. 

Financial institutions operate under the assumption that they may share an individual’s 
personal information with third-parties unless the customer specifically opts-out of such 
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sharing.' Furthermore, a financial institution may share an individual’s "experience 
information" with their affiliates even i/the individual specifically chooses to opt-out of 
the arrangement.^ This exemption effectively allows financial institutions to side-step the 
protections of the FCRA, allowing them to share information among affiliates without 
restrictions. 

Weak protections against affiliate sharing have a number of serious negative 
consequences. First, lax protections against affiliate sharing enable financial institutions 
to participate in fraud. As we explain in detail below, financial institutions have used 
their customer lists to target individuals for fraudulent telemarketing schemes. They have 
also sold personal information acquired from third-parties to fraudulent companies. 
Moreover, the unrestricted sharing of consumers’ information facilitates criminal activity, 
such as theft of financial identity. To make matters worse, the impact upon society is 
uneven, as the unfettered sharing of individuals’ financial information exposes the elderly 
and other at-risk individuals to increased likelihood of fraud. Finally, the risks and 
consequences of affiliate sharing extend beyond fraud. The collection and sharing of 
individuals’ information allows for profiling based on race, age, and educational 
background. While some protections have been placed upon affiliate sharing, financial 
institutions have failed to effectively meet the most basic privacy protection — to provide 
individuals with accurate and meaningful information about affiliate sharing. The 
following expounds upon each of these points. 


A. Financial institutions have used their customer lists to target individuals for 
fraudulent telemarketing schemes. 

Capital One^, Chase Manhattan"', Citibank^, First U.S.A.*, Fleet Mortgage^, GE Capital®, 
MBNA America’, and U.S. Bancorp"* have all provided their customers' personal and 
confidential information to fraudulent telemarketers. The financial institutions provided 

' 15 U.S.C. § 6802(b). 

^ 15 U.S.C. § 1681a(d)(2)(A)(2000). Experience information is information generated from the 
institution's direct dealing with an individual. 

* Office of the Washington State Attorney General, "Settlement with Discount Buying Club Highlights 
Privacy Concerns," Aug. 4, 2000, available at 
http://www.wa.gOv/ago/releases/rel_branddirect_080400.html. 

* Id. 

’ National Association of Attorneys Generals, "Multistate Actions: 27 States and Puerto Rico Settle 
with Citibank," Feb. 27, 2002, http://www.naag.org/issues/20020301-multi-citibank.php; Settlement 
document available at http://www.oag.state.ny.us/press/2002/feb/feb27b_02_attach.pdf. 

‘ Office of the New York Attorney General, "First USA to Halt Vendor's Deceptive Solicitations," Dec. 
31, 2002, available at http://www.oag.state.ny.us/press/2002/dec/dec31a_02.html. 

^ Minnesota v. Fleet Mortgage Corp., 158 F. Supp. 2d 962 (D. Minn. 2001), available at 
http://www.ag.state.mn.us/consumer/PR/Fleet_Opinion_61901.html. 

* Supra, note 1. 

'>Id 

Office of the Minnesota Attorney General, "Minnesota AG and U.S. Bancorp Settle Customer 
Privacy Suit," Jul. 11, 1999, available at 

http://www.ag.state.mn.us/consumer/Privaey/PR/pr_usbank_07011999-html. 
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the telemarketers with the names, telephone numbers, and other information about their 
customers. These institutions also gave the telemarketers the ability to charge customers 
accounts without having to ask consumers to provide an account number. This practice, 
called "preacquired account telemarketing," has subjected thousands of individuals to 
unauthorized charges for products and services they never wanted or ordered. In one 
case, during a thirteen-month period, a national bank processed 95,573 cancellations of 
membership clubs and other products that were billed by preacquired account 
telemarketers without customers’ authorization." 


B. Banks have sold personal information acquired from third-parties to 
fraudulent companies. 

Charter Pacific Bank sold its database containing 3.6 million valid credit card account 
numbers to a convicted felon who then fraudulently billed the accounts for access to 
Internet pornography sites that victims had never visited.'^ In fact, approximately forty- 
five percent of the victims did not even own a computer. Charter Pacific did not develop 
the database from its own customers’ information. Instead, it compiled the information 
from credit card holders who had purchased goods and services from merchants that had 
accounts at Charter Pacific. The information included the date of sale, account number, 
and dollar amount of every credit card transaction processed by the bank’s merchant 
customers. The unrestricted sharing of this information resulted in over $44 million of 
unauthorized charges. 


C. The unrestricted sharing of consumers' information facilitates criminal 
activity, such as theft of financial identity. 

Identity theft is one of the nation’s fastest growing white-collar crimes. Many of these 
identity theft cases are "insider Jobs," committed by employees who obtain access and 
misuse individuals’ personal information stored in their employers’ databanks. 
Researchers at Michigan State University recently studied over 1000 identity theft cases 
and found that victims in fifty percent of the cases specifically reported that the theft was 
committed by an employee of a company compiling personal information on 
individuals.’^ Additional cases implied employee theft. Other reports note that many 
identity fraud cases stem from the perpetrator’s purchase of consumers’ personal 
information from commercial data brokers. Financial institutions information sharing 
practices contribute to the risk of identity theft by greatly expanding the opportunity for 
thieves to obtain access to sensitive personal information. 


" Supplemental Comments of the Minnesota Attorney Genera! Office, FTC Telemarketing Sales Rule, 
FTC File No. R4U001, available at 

http://www.ftc.gov/os/comments/dncpapercomments/supplement/minnag.pdf. 

" Federal Trade Commission, "FTC Wins $37.5 Million Judgment from X-Rate Website Operator; 
Bank Sold Defendants Access to Active MasterCard, Visa Card Numbers," Sept. 7, 2000, available at 
http://www.ftc.gOv/opa/2000/09/netfill.htm. 

" Study forthcoming; results provided in email from Judith M. Collins, Ph.D., Associate Professor, 
Leadership and Management Program in Security School of Criminal Justice, Michigan State 
University to EPIC (Apr. 22, 2003, 18:13:35 EST) (on file with EPIC). 
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D. The unfettered sharing of consumers’ financial information exposes the 
elderly and other at risk consumers to increased likelihood of fraud. 

NationsBank shared with its affiliated securities company data on bank customers with 
maturing federally insured CDs.'"* The affiliate, NationsSecurity, then aggressively 
marketed high-risk investments to these conservative investors, misleading many 
customers to believe that the investments were as safe and reliable as federally insured 
CDs. Many customers, including retired elderly, lost significant portions of their life 
savings. After an investigation, the Securities and Exchange Commission found that the 
companies intentionally blurred the distinction between the bank and the brokerage, and 
between the insured CDs and riskier investment products. Affiliate sharing of customers’ 
information made this possible. NationsBank provided the investment representatives 
with maturing CD customer lists, as well as customers’ financial statements and account 
balances. As a result, when these investment representatives called NationsBanks’ 
customers and indicated that they were with the "investment division" of the bank, many 
customers reasonably believed that they were bank employees, not brokers. NationsBank 
is not the only bank to have engaged in such a practice. First Union settled a private 
lawsuit alleging a similar scheme.'® 


E. The collection and sharing of consumers’ information allows for profiling 
based on race, age, and educational backgroutul. 

Financial institutions conduct computerized analysis of the information they collect about 
their consumers and use that information to target select consumers for the purchase of 
products and services. Often, companies enhance their own collected information by 
combining it with information from other databases. These may include demographic 
data, such as age, gender, and family dwelling size, as well as lifestyle data, including 
predicted attributes based on buying habits and organization affiliations. 

The natural outgrowth of this unlimited collection and sharing of personal data is 
individual profiling. Profiles can be used to determine the amount one pays for financial 
services and related products. For example, according to a sworn declaration of a former 
CitiFinancial employee, branch managers would target deceptive loan solicitations to 
borrowers in certain zip codes, eliminating zip codes in more affluent areas.'® The 
employee also stated that she and other staff would attempt to sell extra insurance by 
identifying vulnerable borrowers based on their occupation, race, age, and education 
level. She stated, "If someone appeared uneducated, inarticulate, or was a minority, or 
was particularly old or young, I would try to include all the coverages CitiFinancial 


Nationssecurities and Nationsbank, N.A., SEC Release No. 33-7532, May 4, 1998, available at 
http://www.sec.gov/litigation/admin/337532.txt. 

Risky Business in the Operating Subsidiary: How the OCC Dropped the Ball, Hearing Before the 
Subcommittee on Oversight and Investigations of the House Committee on Commerce. , 106th Cong. 
(Jun, 25, 1999) (statement of Jonathan Alpert, Sr. Partner, Baker and Rodems). 

FTCv. Citigroup, Inc. No. 1:01-CV-00606, Decl. of Gail Kubiniec.H 10(N.D. Ga. May 2001), 
available at http://www.ftc.gov/foia/citigroup.pdf. 
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offered. The more gullible the consumer appeared, the more coverages I would try to 
include in the loan."'’ 

In a separate case, a Minnesota Attorney General investigation found that the elderly and 
consumers who speak English as a second language were particularly vulnerable to 
preacquired account telemarketing fraud. The Office’s review of randomly selected sales 
of one preacquired account telemarketer, for instance, revealed that fifty eight percent of 
customers whose accounts were charged were over sixty years old.'* 

II. The FCRA does little to protect individuals from the pervasive practice 

of sharing personal information without individuals’ consent. 

The American legal system has a long history of protecting privacy rights through laws 
that arise in response to challenges posed by new technologies and business practices. In 
the past. Congress enacted laws to address privacy risks of the postal system and the 
telephone, and more recently video rentals and cable television. Today, we face new 
challenges. Computers allow the unprecedented storage of individuals’ purchasing and 
financial histories, and new technological programs, like "data mining," facilitate the 
discovery of unanticipated patterns in this stored data. In addition, the recent creation of 
new corporate structures — such as the financial holding company that may own a vast 
array of banks, insurance companies, investment firms, and other institutions — provides 
for the unprecedented sharing of individuals' personal information among affiliated 
companies. The law must adapt and respond to these developments. 


A. Because financial holding companies may consist of a large number of 
affiliates that engage in a variety of activities, FCRA affiliate sharing exemptions 
effectively allow financial institutions to sidestep the purpose of the FCRA. 

The FCRA sets standards for credit reporting agencies for their activities of collecting 
and distributing an individual's personal information. The Act limits access to reports, 
and provides consumers with the right to review, dispute, and correct information 
maintained by credit reporting agencies. Information shared among corporate affiliates, 
however, is not included within the Act's definition of a credit report. As a result, a 
corporation can generate a comprehensive profile about an individual solely from data 
shared among their vast network of corporate affiliates, thus undermining the 
effectiveness of the consumer protections afforded by the FCRA. In essence, affiliate 
information sharing can come to serve like at/e facto credit bureau, making credit 
bureaus obsolete. As affiliate information sharing takes on the functions of the traditional 
credit bureaus, it should take on the FCRA obligations as well. 

The GLBA allows a broad range of institutions to affiliate and operate under a single 
corporate umbrella, called a financial holding company. As such, a financial holding 
company can engage in a wide variety of activities. Citigroup, Inc., for example, consists 
of the following affiliates listed on their website: Citibank, Citi Cards, Citi Financial, 


” Id. at 1 14. 

'* Financial Privacy and Consumer Protection Hearing Before the Senate Comm, on Banking, Housing 
and Urban Affairs, 107th Cong., Sept. 19, 2002 (statement of Mike Hatch, Attorney General, State of 
Minnesota). 
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CitiMortgage, Diner’s Club International, Banamex, Traveler’s Life and Annuity, Smith 
Barney, Primerica, Citigroup Asset Management, Citilnsurance, Citigroup private bank, 
and others. 

In total, CitiGroup has over 2700 corporate affiliates.'^ Similarly, Bank of America has 
almost 1500.^“ As financial holding companies can have thousands of affiliates, 
individuals have little understanding regarding the extent to which companies have 
access to their sensitive information. The law allows affiliate companies to merge their 
customers’ data into one comprehensive database, thereby compiling a comprehensive 
profile about their customers. This database may include financial, medical, and other 
sensitive information. Financial institutions tell their customers that their information is 
only shared within the "corporate family," a phrase with warm and friendly connotations 
suggest that their information is in good hands. Yet, given the vast scope of corporate 
affiliates, in reality an individuals information can spread to over a thousand institutions, 
all the while remaining within this illusory family. Besides the affiliate sharing loophole, 
under GLBA, financial institutions can share personal information, despite an individual’s 
express opt-out, with third-party financial institutions that are not affiliates but are "joint 
marketing" partners.^' 

With both the affiliate sharing and the joint marketing loopholes, a single exchange 
between an individual and a financial institution can transform into a relationship 
between that individual and thousands of other companies, all the while the individual 
has no say in the matter and is unaware of the magnitude of the financial institution’s vast 
affiliate and marketing network. 

III. To protect individuals and help law enforcement, EPIC encourages the 

Senate Banking Committee to adopt an opt-in requirement for affiliate 

sharing. 


A . Opt-out does not meet the needs of individuals. 

With opt-out, the law assumes that banks can distribute customers’ personal information 
freely, unless the customer specifies otherwise. An opt-out system at its heart carries the 
assumption that there will be little response to the notices because the notices will be 
overlooked, or will be too complicated to understand. Like other negative choice systems, 
permission though silence will invariably get a large percentage of "yes" responses 
because no response is necessary. 

Companies often assert that the low percentage of opt-out rates indicate that customers do 
not in fact value the privacy of their personal information. Expert studies illustrate that, in 
fact, few consumers recall seeing notices even when the notices are required to be clear 
and conspicuous, which suggests that when businesses do not want consumers to see a 


” Financial Privacy and Consumer Protection Hearing Before the Senate Comm, on Banking, Housing 
and Urban Affairs, 107th Cong., Sept. 19, 2002 (statement of William H. Sorrell, Attorney General, 
State of Vermont). 

^Id. 

15 U.S.C. § 6802(b)(2). 
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notice, consumers will not.^^ Furthermore, the notices are difficult to understand. A 
readability expert determined that, of sixty privacy notices examined, most were written 
at a third or fourth year college reading level, rather than the eighth grade level standard 
typically used for notices to the general public.^^ 

Evidence regarding opt-out notices provided in other contexts suggests that companies 
may purposely be drafting unintelligible notices to mislead customers. In Ting v. AT&T, a 
district court found that AT&T conducted research to develop a notice regarding new 
contract terms that consumers would be likely to consider as a "non-event.''^'’ 

Furthermore, financial institutions may make it difficult for individuals to opt-out through 
various burdensome procedural barriers. Recently, EPIC obtained documents through a 
FOIA request to the FTC, asking for their complaints regarding GLBA violations. Almost 
all of these complaints were from individuals who faced serious burdens when they tried 
to opt-out, or whose opt-out request was ignored altogether. A majority of these 
complaints concerned Citibank. 

Companies do not identify with adequate specificity what information they share, or the 
possible recipients of personal information. Consequently, if information is misused by 
one of the thousands of an institution’s affiliates and marketing partners, individuals will 
continue to have trouble identifying the offender. 


B. Individuals want opt-in protections. 

In a 2003 Harris Poll, seventy-nine percent of surveyed adults reported that it is 
extremely important to be in control of who can obtain their personal information. The 
survey also revealed a growing distrust of businesses’ information handling practices. A 
majority (fifty-four percent) disagreed with the statement that "most businesses handle 
the personal information they collect about consumers in a proper and confidential way," 
an increase of nineteen points from only thirty-five percent who felt this way in 1999. 
Other public opinion polls consistently find that Americans want strong privacy 
protection laws. 


“ Jeff Sovern, "Opting in. Opting Out, or No Options at All: The Fight For Conuol of Personal 
Information," 74 Wash. L. Rev. 1033, 1099 (1999). 

^ Mark Hochhauser, Lost in the Fine Print: Readability of Financial Privacy Notices, July 2001, 
available at http://www.privacyrights.org/ar/GLB-Rcading.htm. 

^ "Another part of AT&T’s research, the Qualitative Study, concluded that after reading the bolded text 
in the cover letter which states ’please be assured that your AT&T service or billing will not change 
under the AT&T Consumer Services Agreement; there’s nothing you need to do,’ ’at this point most 
would stop reading and discard the letter. ’ (J. Ex. 9-9.) One of the authors of the study did not find this 
conclusion to be a cause of concern, and no one on the detariffing team ever expressed concern to her 
about this conclusion." Ting v. AT&T, 182 F. Supp. 2d 902 (N.D. Cal. 2002). 

24. " . . . AT&T was concerned that if its customers focused on the Legal Remedies Provisions, they 
might become concerned, less likely to perceive detariffing as a non-event and possibly defect. As a 
high ranking member on the detariffing team stated: 'I don’t want them to tell customers that now 
individual contracts need to be established with customers and pay attention to the details [sic].' (Pis.' 
Ex. 132-1.) While presenting the CSAas a non-event may have helped AT&T retain its customers, it 
also made customers less alert to the fact that they were being asked to give up important legal rights 
and remedies." Id. 
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Most notably, last year, individuals for the first time had the opportunity to vote directly 
on opt-in privacy protections, and on June 11, seventy-two percent of North Dakota 
residents chose opt-in over opt-out privacy protections. Also, in California, a number of 
jurisdictions have passed opt-in laws, including San Francisco, San Mateo, Contra Costa, 
Alameda, Santa Cruz and Solano counties, and Daly City. 


C. Opt-in is more efficient than opt-out. 

Proponents of an opt-out approach argue that such a system is economically preferable, 
as it increases the amount of information available to both producers and consumers, 
allows telecommunications carriers to improve services offered by tailoring these 
services to specific customers, and reduces prices. This assertion erroneously assumes 
that the only costs at issue are those of production, without accounting for increased 
transaction costs incurred by the consumer in seeking to exercise privacy rights created 
by statute.^^ 

Opt-out regimes create an economic incentive for businesses to make it difficult for 
consumers to exercise their preference not to disclose personal information to others. 
Because opt-out systems do not require businesses to create inducements for consumers 
to choose affirmatively to disclose personal information, these systems encourage firms 
to engage in strategic behavior and thus inflate consumer transaction costs."® In contrast, 
an opt-in system would permit consumers who wish to protect their privacy to do so, 
while encouraging telecommunications carriers to eliminate consumer transaction costs.^’ 
Because carriers profit from the use of consumer information, and thus want as much 
information as possible, carriers would have an incentive to make it as easy as possible 
for consumers to consent to the use of their personal information. Such a system might 
include a comprehensible list of the benefits to opting-in, contained within a clearly 
marked mailing, with a pre-paid stamped envelope. This would preclude the transaction 
costs involved with attempting to contact via phone customers with the authority to opt- 
in. It also reduces the strategic behavior costs associated with opt-out — the costs 
associated with providing consumers a message that they do not want consumers to 
receive — ^because the telecommunications carriers would have an incentive to lower costs 
associated with providing customers a message that they are very eager to have the 
customer receive.^* Finally, opt-in may decrease the amount of information in the 
marketplace, but it permits telecommunications carriers to target products at those who 
have specified an interest in such information: thereby decreasing the wasted costs 
associated with targeting uninterested customers.^’ 


See Sovem, supra note 22, at 1082-83. 
See id. at 1099-1100. 

See id. 

See id. at 1101-02. 

See id. at 1103. 
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D. Conclusion 

Affiliate sharing and joint marketing loopholes allow financial institutions to exploit 
individuals’ information despite the individual’s wishes to the contrary. Financial 
institutions should obtain opt-in consent before disseminating personal information to 
third-parties, affiliates, and joint-marketers. 

Financial institutions argue that it is in the best interest of the customer to allow the 
institution to share personal information because it allows greater customer service. Their 
assumption is paternalistic, and it assumes that individuals cannot decide for themselves 
what is in their own best interest. As surveys show, individuals prefer to have the 
decision-making authority through opt-in requirements. Moreover, requiring financial 
institutions to get informed opt-in consent from individuals before sharing their 
information will go far to protect individuals from fraud, crime, discrimination, and 
privacy violations. 

EPIC respectfully urges the Committee to promulgate the proposed opt-in standard for 
the disclosure of customer information. Although EPIC believes that these comments 
provide support for a regulation implementing an opt-in approach towards all customer 
information — including affiliate sharing — ^EPIC applauds the Committee's efforts to 
restrict use of more sensitive forms of customer information. 


Respectfully Submitted, 



John Baggaley 
IPIOP Law Clerk 

Waseem Karim 
IPIOP Law Clerk 



ACCURACY OF CREDIT REPORT 
INFORMATION AND THE 
FAIR CREDIT REPORTING ACT 


THURSDAY, JULY 10, 2003 

U.S. Senate, 

Committee on Banking, Housing, and Urban Affairs, 

Washington, DC. 

The Committee met at 10:02 a.m. in room SD-538 of the Dirksen 
Senate Office Building, Senator Richard C. Shelby (Chairman of 
the Committee) presiding. 

OPENING STATEMENT OF CHAIRMAN RICHARD C. SHELBY 

Chairman Shelby. Good morning. 

The Committee will come to order. Today, we take up one of the 
most important issues, if not the most important, associated with 
the Fair Credit Reporting Act: The accuracy of the information con- 
tained in consumer credit reports. Changes in our financial services 
industry have made accuracy more important than ever. Credit re- 
port information is increasingly used as the key determinant of the 
cost of credit or insurance. By way of risk-based pricing, gone are 
the days when lenders merely lumped borrowers into the “quali- 
fied” or “unqualified” category. The use of risk-based pricing allows 
lenders to extend credit to a broader range of borrowers predicated 
on the assumption that borrowers receive credit terms which are 
commensurate with the credit risk that they pose. As a result, 
credit report information has a direct impact on the amount and 
the interest rates at which credit is offered. 

With respect to large credit transactions, such as mortgages, rate 
differences can translate into hundreds of thousands of dollars over 
the course of a loan. Even in smaller dollar credit transactions, 
such as credit cards, rate differences can mean large amounts of 
money. Furthermore, with the practice of credit card companies re- 
viewing credit reports and adjusting rates in real time becoming 
more prevalent, the application of risk-based pricing to consumer 
finances is practically an everyday event. 

Let me try to further illustrate these points, and we have some 
charts here. The first chart. Chart 1 *, provides some rough indica- 
tion as to the effects that particular entries on a credit report can 
have on a person’s credit score or creditworthiness. As indicated, 
some entries, such as bankruptcy filing, can greatly reduce a per- 


* This chart is included in Chairman Shelby’s prepared statement on pg.400. 
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son’s creditworthiness. You can see the numbers from the chart 
here that Mr. Oesterle is holding. 

There is nothing wrong with this. Consumers who have failed to 
pay their debts, again, do pose a considerable risk to creditors, and 
we need to acknowledge that. But what if a bad rating is based on 
inaccurate information? What if you had never been bankrupt and 
such an item appeared on your credit report? 

Now I just want to reference Chart 2*. The second chart high- 
lights the spreads in interest rates that people with differing credit 
scores would pay for some sample products. As the chart shows, 
the differences are very real. So are the financial consequences. For 
example, consider the cost differences for a $200,000, 30-year fixed 
mortgage. A borrower classified as a “marginal risk” pays almost 
$90,000 more in interest than someone with an excellent credit rat- 
ing. Someone classified as a “poor” credit risk would pay $124,000 
more in interest than the person with excellent credit. 

Credit rating matters for other transactions as well. Someone fi- 
nancing a $24,000 new car with a “mar^nal” rating can expect to 
pay 127 percent more in interest, about $3,300, than a person with 
excellent credit. Someone with “poor” credit can expect to pay 255 
percent more in interest, about $6,700 more. Again, what if the in- 
formation that leads to a bad credit rating is inaccurate? 

With the rewards for good credit so meaningful and the penalties 
for bad credit so severe, it is absolutely critical that credit reports 
accurately portray consumers’ true credit histories, thus the focus 
of today’s hearing: Examining the Fair Credit Reporting Act and 
the operation of our credit markets to determine whether or not the 
present system provides optimum accuracy. 

With a system as large and complex as ours, involving the trans- 
fer of billions of pieces of information, it is almost a certainty that 
there are going to be some errors which occur. On the other hand, 
the credit reporting agencies are paid to properly handle the data. 
And furnishers, who also happen to be the largest consumers of 
credit report information, take advantage of the efficiencies pro- 
vided by the system. Both derive significant benefits from this sys- 
tem. Both also have a significant responsibility to get things right. 

So let us consider: How and why do errors occur in credit report- 
ing? Can more be done to prevent errors in the first place? If some 
errors are not preventable, does the system enable them to be 
quickly recognized? Who most efficiently recognizes them? And 
once recognized, does the system work to ensure that errors are 
quickly corrected? 

I look forward to examining these questions with the witnesses. 

Senator Sarbanes. 

STATEMENT OF SENATOR PAUL S. SARBANES 

Senator Sarbanes. Mr. Chairman, thank you very much, and 
thank you for holding this hearing on accuracy in credit reporting. 
Accuracy of credit report information is integral to our reporting 
process. In fact, the Fair Credit Reporting Act’s first finding is that, 
“The banking system is dependent upon fair and accurate credit re- 
porting.” The Act goes on to say, “Inaccurate credit reports directly 


*This chart is included in Chairman Shelby’s prepared statement on pg.401. 
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impair the efficiency of the banking system, and unfair credit re- 
porting methods undermine the public confidence which is essential 
to the continued functioning of the banking system.” 

That is right out of the Act itself And yet, credit report inaccura- 
cies continue to plague consumers. The U.S. Public Interest Re- 
search Group has conducted several studies with respect to credit 
report accuracy, and in their most recent study in 1998, found that 
29 percent of the credit reports which they studied contained seri- 
ous errors that could result in a denial of credit. Now, this morning 
we will hear, on the second panel, from the Consumer Federation 
of America, who, I understand, examined credit scores and reports 
from all three major credit repositories and found that inaccuracies 
remain a significant problem in consumer credit reports. 

The fact is, we need much better information regarding the accu- 
racy of credit reports. 

Erroneous negative information on credit reports can often take 
a significant investment of time and money to remove. Errors can 
also be very costly to consumers by significantly raising borrower 
costs. Not only do such inaccuracies raise the cost of borrowing, but 
they may also actually cost the consumer the loan. Insurers, mort- 
gage banks, and other financial institutions rely heavily on credit 
scores to make credit decisions. Inaccuracies in the underlying 
credit reports can, therefore, make it more difficult and signifi- 
cantly more expensive for Americans to purchase insurance, homes, 
cars, and other big-ticket items. 

Our first witness this morning is Chairman Muris from the FTC. 
As you may know. Chairman Muris, Mr. Beales, the Director of the 
FTC’s Consumer Protection Division, has testified at two of our 
previous hearings. At our identity theft hearing, I mentioned to 
him that I considered it essential that we hear some recommenda- 
tions from the FTC on ways to improve some of the problems that 
we have been hearing about with respect to the Fair Credit Report- 
ing Act. There are a number of interested parties who believe that 
additional regulatory and enforcement authority is needed by the 
FTC to administer the FCRA. In addition to credit report accuracy, 
I hope that you will address this issue, as well as a number of 
other issues that have been brought to the Committee’s attention, 
including: Alleged marketing abuses, the prescreening process, lack 
of financial privacy, risk-based pricing, and the use of credit scores 
for insurance purposes, among other issues. 

Mr. Chairman, I look forward to FTC Chairman Muris’ testi- 
mony, and I also look forward to the testimony that will come from 
the second panel. And in case I am not here at the moment that 
second panel begins, I want to take a moment to welcome Evan 
Hendricks, a resident of the State of Maryland. Mr. Hendricks was 
the Founder of the Privacy Times newsletter, has been its Editor 
for 23 years, and has testified before Congress a number of times 
on Fair Credit Reporting Act issues. His expertise has been helpful 
in the past, and I am sure will continue to be helpful as the Com- 
mittee examines the functioning of the credit reporting system and 
the ways in which consumers’ credit reports are affected. 

Thank you very much. 

Chairman Shelby. Senator Dole. 
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STATEMENT OF SENATOR ELIZABETH DOLE 

Senator Dole. Thank you, Mr. Chairman. 

The accuracy of credit reports is a key issue, of course, for us to 
examine as we consider reauthorizing the Fair Credit Reporting 
Act. And I thank you, Mr. Chairman, for giving us this opportunity 
to review and discuss these issues in greater detail. 

Under the Fair Credit Reporting Act, credit bureaus must, “As- 
sure the maximum possible accuracy of the information concerning 
the individual about whom the report relates.” However, in recent 
hearings, we have heard anecdotes about the harm caused to con- 
sumers who have had false information on their credit reports as 
a result of mistakes or fraud. It is my hope that as part of this ef- 
fort, we can agree upon positive steps to ensure greater accuracy 
in credit reports. 

Recently, my staff and I purchased copies of our credit reports, 
as well as sample credit scores as preparation for our work on this 
issue. I was pleased to discover that my credit reports were entirely 
accurate and easy to understand. All of the information contained 
in the report was, in my opinion, appropriate and necessary. In ad- 
dition, the sample FICO credit score gave simple and understand- 
able explanations for the factors used in its determination. 

We have, of course, heard testimony before this Committee on 
the problems some consumers have faced with respect to the credit 
bureaus. And, particularly. Captain John Harrison, a victim of 
identity theft, described to us on June 19 how information that had 
been removed from his credit report reappeared later. One of our 
goals here should be to do all we can to prevent such things from 
happening in the future. These errors can truly wreak havoc in a 
person’s life, with effects that can linger for years or for a lifetime. 

One positive sign that we are making progress was the truly bi- 
partisan Fair Credit Reporting Act reauthorization bill that was re- 
cently introduced in the House. This proposal contains provisions 
that address many of the concerns voiced by consumer groups and 
the industry. The Administration also recently announced that it 
supports much of this approach, leading me to believe that we are 
well within sight of being able to sign off on a positive, consensus- 
based approach to reauthorization. 

I want to take a moment to welcome Chairman Muris from the 
Federal Trade Commission who is with us today. As an alumnus 
of the FTC, it is a special pleasure to hear from you this morning. 

And, Mr. Chairman, I stand ready to work with you and the rest 
of our colleagues as we move toward achieving our goal of reau- 
thorization this year. 

Thank you. 

Chairman Shelby. Senator Johnson. 

STATEMENT OF SENATOR TIM JOHNSON 

Senator Johnson. Mr. Chairman, thank you for holding today’s 
hearing on the accuracy of credit reporting information and the 
Fair Credit Reporting Act. Welcome to Chairman Muris and the 
second panel. 

As I have noted in past hearings, the last thing our weakened 
economy needs is a blow to the credit-granting system. In fact. 
Treasury Secretary Snow stated yesterday that if the national 
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standards were to expire and States adopted new laws currently 
under consideration, a minimum of 3.5 percent of loans now ap- 
proved would be denied to maintain the same level of credit risk. 
That translates to at least $270 billion of the current total of just 
under $8 trillion in consumer credit outstanding could be in jeop- 
ardy, according to Secretary Snow. 

So, Mr. Chairman, I thank you for focusing our attention on 
America’s credit-granting system. The reason credit is so widely 
available and so affordable is due in large part to the amount of 
data available to lenders and other users of credit reports. Quan- 
tity is no substitute for quality, and I hope we can work together 
to make any adjustments to the underlying statute to increase the 
quality of the data without creating unintended consequences that 
deter data furnishers from participating in the system. 

I am very pleased that the Administration and the FTC have 
now taken a public position in favor of permanently extending the 
preemption provisions of FCRA. I think a number of us on the 
Committee were beginning to feel a little sorry for Mr. Beales who 
appeared before us a couple times to tell us about how well FCRA 
is working, but was unable to say whether it might be better to let 
the California Legislature write the statute for us. 

I hope that Chairman Muris will spend some time today talking 
about how our system would change if we lose uniformity of credit 
data. However, I am sure we all agree that the last thing we want 
is a uniformly bad system, which is why we need to look hard at 
the current statute to determine whether changes need to be made. 

I have read Mr. Jokinen’s testimony, and I am pleased to see him 
alive and well before us. And while Mark Twain might have chuck- 
led over reports of his untimely death, it is no laughing matter 
when those reports deprive you of historically low mortgage rates 
and cause very real emotional damage in the process of correcting 
the information. 

I regret that we do not have any data furnishers with us today. 
It sounds to me as if the breakdown in Mr. Jokinen’s case may 
have had more to do with the data furnisher than with the credit 
bureau. But what is clear is that the system failed this witness, 
and we need to figure out if the statute itself is at fault or if we 
need to focus on enforcement. Clearly, there is enough blame to go 
around, and the fact is everyone benefits from accurate data. 

So, I look forward to working with you, Mr. Chairman, and other 
Members of the Committee on a quick and responsible reauthoriza- 
tion process. Again, I have conflicting, overlapping committee hear- 
ings, including markups going on. I may not be able to stay as long 
as I would like. But, I thank you for conducting this hearing. 

Chairman Shelby. Senator Enzi. 

STATEMENT OF SENATOR MICHAEL B. ENZI 

Senator Enzi. Thank you, Mr. Chairman. I appreciate your hold- 
ing this hearing and the other hearings that you are holding to 
steadily move us toward a consensus on getting this important re- 
authorization done. The accuracy of financial information collected, 
maintained, and delivered by the credit reporting agencies is vital 
to ensuring the integrity of our entire financial system. I was very 
pleased to hear Secretary Snow of the Department of the Treasury 
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announce last week that the Administration supports making free 
credit reports available annually to consumers. 

This will go a long way to helping consumers to understand what 
information is retained by the credit reporting agencies, to see if 
there are any inaccuracies in the information, and to correct that 
information. The accuracy and timeliness of the information will 
help consumers, merchants, and financial institutions to stem the 
explosion of identity theft crimes. 

I also want to mention two articles that I believe highlight the 
problems that we face with identity thefts. The first article was a 
front-page article in The Wall Street Journal on May 1 entitled, “A 
Tussle Over Who Pays For Credit Card Theft — Retailers Stuck 
With the Bill, Say Issuers Lack a Reason To Fight.” The second ap- 
peared recently — in fact, last weekend — in Parade magazine. 

I am concerned about the situations highlighted in The Wall 
Street Journal article where victims of identity theft struggle to re- 
tain their identities and the credit card industry appears to offer 
little help in pursuing the criminals. Further, it is troublesome that 
the retailers, most likely small business retailers, may get stuck 
with the cost of the crime. The financial cost of identity theft is 
growing at a very alarming rate, and we have to find ways to en- 
courage credit card companies to track down fraudsters and help 
retailers recover damages. Therefore, I would like to hear from 
Chairman Muris as to what the Federal Trade Commission is doing 
to bring credit card companies to the table and what the Commis- 
sion is doing to help small retailers cope with identity theft. 

With regard to the Parade magazine article, my colleagues will 
remember — and Senator Dole already mentioned — Captain John 
Harrison who had testified at the June 19 hearing. The article il- 
lustrates the trauma that Captain Harrison has experienced as a 
victim of identity theft since July 27, 2001. For nearly 2 years. 
Captain Harrison has been trying to clear his good name. That 
means closing over 60 fraudulent accounts that range from credit 
cards to checking accounts to utilities. And, those are just the ones 
he knows about. Captain Harrison is still learning about open and 
damaging accounts. 

He is just one individual whose life has been turned upside 
down. There are a hundreds of thousands more out there, and we 
have to do something to help these victims. 

Last year. Senator Cantwell and I introduced a bill that would 
assist victims in reclaiming their identities. The bill passed unani- 
mously in the Senate last November. It did not pass the House, 
however, and I would like to work with our esteemed Chairman to 
ensure that parts of that bill are reauthorized in the Fair Credit 
Reporting Act. Some of these parts may be similar to the changes 
proposed by the Administration relating to accuracy of information 
in a consumer’s file. I am particularly interested in the Administra- 
tion’s proposal related to the blocking of files and reinvestigations 
by resellers. Senator Cantwell and I worked last year with all of 
the stakeholders to address these issues in our bill, and I would ap- 
preciate the opinion of Chairman Muris and the other panelists on 
the Administration’s proposal. 

In addition, I believe we need to discuss the accuracy of con- 
sumer’s data when the consumer is also a small business. Accord- 
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ing to the Small Business Administration, there are millions of 
small businesses that are sole proprietors. Over the past decade, 
there has been a very good campaign on the part of financial insti- 
tutions to market products and services to small business owners. 
This has made credit available to many sole proprietors that other- 
wise would not have been able to obtain credit elsewhere. I would 
like to hear from today’s witnesses as to how we can maintain the 
accuracy of consumers’ financial information if the consumer also 
owns a business. 

Thank you, Mr. Chairman, for holding this hearing. I look for- 
ward to hearing from the witnesses. 

Chairman Shelby. Senator Carper. 

COMMENTS OF SENATOR THOMAS R. CARPER 

Senator Carper. Mr. Chairman, thank you. To my colleagues, to 
our witnesses, and other guests, welcome. Chairman Muris, good to 
see you. Thank you for joining us today. 

I just want to mention briefly three principles that I think we 
will all be able to subscribe to as we approach today’s hearing. One 
of those principles is the need for accuracy of credit reports and 
something that is essential, first of all, to consumers. The second 
principle would be that accurate reports are also of a great benefit 
to those who grant credit. And, finally, the belief that absolute ac- 
curacy cannot be achieved; however, the system should have as few 
errors as possible. And the system that we are working with here 
and refining here should make it easier for consumers to correct er- 
rors in their credit reports. 

I think those are three good principles that we can all subscribe 
to, and I am encouraged with the announcement by the Adminis- 
tration of their position on these issues. Today, we are going to 
make a step forward toward reaching those principles. I am encour- 
aged that the House legislation has been introduced and is starting 
to move. It will be helpful toward that end. 

Finally, we have had quite a few hearings with respect to FCRA, 
and they have been enlightening and educational. And I suspect 
that this will be true today. 

Thank you, Mr. Chairman. 

Chairman Shelby. Senator Bennett. 

STATEMENT OF SENATOR ROBERT F. BENNETT 

Senator Bennett. Thank you very much, Mr. Chairman. All of 
us are very much in favor of accuracy within the credit bureaus 
and the information that is reported. I want to change the focus 
just a little in my opening statement to accuracy of studies. 

Senator Sarbanes quoted a study that said 29 percent of the 
credit records contained errors. There is a 1992 study commis- 
sioned by the Consumer Data Industry, which is the trade associa- 
tion group, that says the error rate is 0.2 percent. There is a 1998 
study conducted by the U.S. Public Interest Research Group that 
says the error rate is 70 percent. 

That is a pretty wide range, a 0.2-percent error rate or a 70-per- 
cent error rate or a 29-percent error rate. If we are going to legis- 
late to try to bring down the error rate, we have got to know what 
the error rate really is. And these kinds of studies are all over the 
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place. To go from 0.2 percent, some will say that is suspect because 
it was a study commissioned by the industry itself; to 70 percent, 
I frankly think that is obviously suspect, commissioned by someone 
who may hate the industry. We need to know exactly what the 
error rate is. 

Furthermore, Mr. President — Mr. Chairman. Sorry, a Freudian 
slip with all the other colleagues around here. 

[Laughter.] 

We need to know accurately what an error is. I will give you an 
example out of my own life. We moved in Salt Lake City, and when 
you do that, you call people up and tell them that you have moved, 
and they put a new address on your bill. No matter how hard I try, 
I am unable to get the Salt Lake City Corporation to bill Robert 
F., as in Frank, Bennett. They insist on billing Robert S., as in 
Sam, Bennett. Someone heard that as an “S” over the telephone 
when we changed our address, and that constitutes an error. 

Now, it could be a very serious error in that there might be a 
Robert S. Bennett out there who is rampaging around the credit 
world and I do not want to be associated with him. On the other 
hand, I really do not think that the fact that my water bill is ad- 
dressed to Robert S. Bennett at 1224 11th Avenue, Salt Lake City, 
Utah, when it really is Robert F. Bennett at that address con- 
stitutes an error that justifies Federal legislation. 

So as we examine this whole question of the error rate in these 
databases, we need to know what kind of errors we are talking 
about, and we need to be able to separate those that are incidental 
from those that do constitute a threat to our identities. 

The only piece of data that I have been able to find out that I 
think moves in the direction of giving us an accurate picture of 
what is going on is information that we have had from the FTC, 
and I simply repeat it here. The FTC reports that they receive ap- 
proximately 2,000 complaints per year per bureau — since there are 
three bureaus, that is 6,000 error complaints — out of a database of 
600 million. 

Now, I realize that not every error by any means gets reported 
to the FTC. But those that felt concerned enough about the errors 
that they contacted the FTC gives us 6,000 on a database of 600 
million, which is 0.001 percent. Perhaps more significant than this 
number is the fact that in 1990, the FTC was receiving 10,000 com- 
plaints per year per bureau. So over a decade, we have seen the 
complaints on errors go from a total of 30,000 down to 6,000 as far 
as the Feds are concerned. 

Now, this is not a survey. This is not a study. This is not a poll. 
These are actual complaints coming into the Federal Government 
that signify the trend is going in the right direction. Six thousand 
is one-fifth of 30,000. So, in 10 years, we have had an 80-percent 
improvement rate in the complaints to the FTC while the granting 
of credit has gone up dramatically. I think that says that the Fair 
Credit Reporting Act has done a pretty good job. 

Now, having said that, I am as concerned about making sure 
that the database is accurate as anyone else on this Committee. 
But I think as we pursue the goal of getting a higher rate of accu- 
racy, we need to do so against the background of accurate informa- 
tion about what the problem really is and how bad it is. 
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Thank you. 

Chairman Shelby. Senator Dodd. 

STATEMENT OF SENATOR CHRISTOPHER J. DODD 

Senator Dodd. Thank you, Mr. Chairman. I ask that my pre- 
pared statement be included in the record. 

Chairman Shelby. Without objection, it is so ordered. 

Senator Dodd. I think most of the comments that I would make 
have been included, just striking the balance. Thank you, Mr. 
Chairman, for holding this hearing. It is extremely important. All 
of us as we travel around, no matter where we go, the issue comes 
up about whether or not we are going to reauthorize the FCRA, 
when we are going to do it, and what is it going to look like. I think 
these hearings are tremendously helpful, and I want to commend 
you. We have already listened to a lot of people and we are going 
to hear from some wonderful witnesses today who will share with 
us their views and thoughts on this very important subject, and 
that is tremendously worthwhile. As we move into an economy that 
requires some straightening out, credit is going to be even more im- 
portant in terms of getting back on its feet again. So having a level 
of confidence that people will need is going to be essential. 

I appreciate my colleague from Wyoming mentioning Captain 
Harrison, my constituent from Connecticut, who gave eloquent tes- 
timony. His is certainly an incredible case. What he has been 
through is just stunning to identity theft issues. We know this may 
be an extreme case, but I think most people recognize that it prob- 
ably occurs far more often than we all like to admit, even though 
studies may vary about the percentage of incidences. 

I just want to end on the note that the Treasury Department is 
moving in the right direction, and I want to commend them. I 
spend a lot of time saying what I think the Treasury Department 
is doing wrong, but in this case, I think the Treasury Department 
deserves some credit for its recent recommendations dealing with 
consumer protections. For example, it is right, I think, to suggest 
that consumers should have the right to free copies of their credit 
reports and credit scores so that they can identify the problems for 
themselves. Obviously, you can solve a lot of problems if you can 
have a chance to look at your own stuff and think something is 
wrong. That would seem to be helpful and positive, and I commend 
them for it. 

I also agree that we need to strengthen the protections against 
fraud, identity theft, and the like that they have made rec- 
ommendations on. So, I am anxious to hear what other thoughts 
can be offered to us as we try and fashion this legislation. I think 
what Senator Carper said makes a lot of sense. Those are pretty 
good standards by which to judge how we are progressing here. 
There is the realization you are not going to have a perfect system, 
and any hopes of achieving that should be put aside immediately. 
But today with our technology and sophistication, we can do a bet- 
ter job all the time in guaranteeing that, to the extent possible, the 
consumers are being protected by accuracy of information that de- 
termines whether or not they are creditworthy. 

Again, Mr. Chairman, I thank you for your efforts. 

Chairman Shelby. Senator Crapo. 
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STATEMENT OF SENATOR MIKE CRAPO 

Senator Crapo. Thank you, Mr. Chairman. As Senator Dodd in- 
dicated, most of — in fact, all of my thoughts have been very well 
stated by other Members of the Committee, so I will be brief. 

I want to thank you for not only this hearing, but the series of 
hearings that you are holding on this legislation because I think 
they have helped us to focus very well on the issues at hand. 

I have said before that I think our primary obligation here as we 
approach this legislation is to make certain that we protect the 
credit reporting system that we have in the United States today, 
which is the envy of the world and is the backbone and a strong 
part of our economy. In fact, I think the statistics I have seen indi- 
cate that something like three-fourths of all American households 
are involved in some way with the credit system in this country, 
and that frankly to me sounds like it might be a little bit low, ei- 
ther in the mortgage credit system or in the consumer loan system. 

As I approach this, we have already had hearings on identity 
theft and a number of other issues that directly relate to the issues 
we have before us here today. But it seems to me that we want to 
make sure that the information that we are dealing with in our 
credit reporting system is complete, that it is accurate, that it is 
accessible by consumers, that it is understandable by consumers so 
that those who are dealing with their own credit information — 
whether it is in the context of identity theft or just in terms of a 
report that they are getting in terms of a credit transaction or just 
in terms of checking their credit rating — that they understand 
what it is that they are dealing with, and that it is fixable when 
errors occur. So that when a consumer finds that there has been 
a problem, whether it is a minor problem like Senator Bennett has 
identified or a major problem like an identity theft problem, or sim- 
ply poor reporting or poor standards or poor procedures by the re- 
porting agency, that it is fixable. And I think that means we might 
need to look at modernizing our dispute resolution process and 
some of the other ways that we address these issues. 

Finally, I think we need to make sure that the adequate protec- 
tions are in place to assure that we do not have identity theft or 
fraud or inappropriate reporting mechanisms and that the entire 
industry, including the consumers, understand how the system 
works and are able to work with it easily. 

So, again, Mr. Chairman, I thank you for holding these hearings, 
and I look forward to working with you as we craft this legislation. 

Chairman Shelby. Thank you. Senator Crapo. 

Senator Stabenow. 

STATEMENT OF SENATOR DEBBIE STABENOW 

Senator Stabenow. Thank you, Mr. Chairman. I have a complete 
statement that I would ask to have placed into the record. 

Chairman Shelby. Without objection, it is so ordered. It will be 
in the record. 

Senator Stabenow. Thank you. Just a couple of comments. 

First, welcome, Mr. Chairman. We appreciate your being here 
and your work, and I would share the same concerns my colleagues 
have and as Senator Crapo just indicated in terms of what this is 
all about: accuracy of information for consumers, the ability to 
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maintain a system that is the envy of the world. And we certainly 
want to extend, I believe, not only the existing provisions of the Act 
in a timely manner, but we also need to use this opportunity to 
look for ways to improve areas where there may be problems and 
concerns. So, I welcome your thoughts on that today. This is really 
our opportunity to do that. And when there is a problem for con- 
sumers, we want to make sure that it can be addressed quickly, 
that there is a way for us to remedy problems with our own credit 
reports or others that we represent. 

Mr. Chairman, I did just want to also mention on another front 
that one of the best ways, I think, in the long run that we can help 
on these issues is through making sure that we all have the edu- 
cation and financial literacy that we need in order to be educated, 
active consumers. Senator Enzi and I are working together on some 
legislation that we hope to bring to you and work with the Com- 
mittee on. I know Senator Corzine is working on this issue, and 
other Members of the Committee. But I think it is important that 
provisions that move us forward on financial literacy are also a 
part of what we are doing in making sure that we are all educated 
consumers in using information in order to protect our own inter- 
ests and our own financial situation. 

Thank you, Mr. Chairman. 

Chairman Shelby. Senator Allard. 

STATEMENT OF SENATOR WAYNE ALLARD 

Senator Allard. Mr. Chairman, thank you. I have a full state- 
ment I would like to make a part of the record. 

Chairman Shelby. It will be made part of the record. 

Senator Allard. I want to just make a couple of brief comments. 

First of all, I would like to associate myself with the comments 
of the Senator from Idaho, but I would add a couple of things. We 
are all human, and errors do occur. I think when errors do get into 
a credit report, we need to find ways that those errors can be expe- 
ditiously purged from the public record. So often an error is re- 
corded by one group but it gets dispersed throughout the entire 
system. Other systems record this error and, it reemerges again. I 
hope that some time and thought is given to recorded errors. I also 
hope we can look at how that error can be readily purged so the 
consumer gets that mistake eliminated from the record and is able 
to move on with their own personal lives and investments. 

The second comment I would make is that earlier this week. Sen- 
ator Schumer and I drew up a piece of legislation on disclosure of 
credit scores. I think full transparency of credit scores is important 
so that the consumer — if there is something impacting their credit, 
can respond to it. There are things that go into a credit score that, 
frankly, when I found out about them, I was surprised. I think a 
lot of consumers are unaware of the factors that make up their 
credit score. For example, if a customer is informed that their in- 
terest rate is higher than ordinary; or they get turned down, they 
do not know how to take the necessary steps to make themselves 
qualify again for a lower interest rate or a loan. 

These are two additional comments I wanted to make, and thank 
you, Mr. Chairman. 

Chairman Shelby. Senator Corzine. 
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COMMENTS OF SENATOR JON S. CORZINE 

Senator Corzine. Thank you, Mr. Chairman. 

I want to congratulate you on the thoughtful way of approaching 
this overall issue. I think it is important that it get fleshed out in 
its fullness. I think we all recognize how important this is to each 
individual life. I think about two-thirds of our economy is driven 
by consumer activities. It even rises at certain points in time. And 
this is an enormous area of concern, and when you have the range 
of variables that Senator Bennett talked about of errors, I think we 
should understand how much that actually translates into indi- 
vidual life experience. 

I think the only other comment I would make — and I hear this 
over and over. This is an interconnected element of activity. Accu- 
racy ties to identity theft, which ties to financial literacy, which 
ties to credit scores. And we should be thinking about this in a 
comprehensive way as opposed to piecemeal. And I think like many 
other Senators, I have pieces of this with respect to financial lit- 
eracy, and with respect to questions on identity theft. Frankly, I 
think there is a need for this to be brought together in a com- 
prehensive format so that we aid the consumer on a complete basis. 

Thank you. 

Chairman Shelby. I appreciate your remarks. 

Senator Schumer. 

STATEMENT OF SENATOR CHARLES E. SCHUMER 

Senator Schumer. Thank you, Mr. Chairman. Again, I want to 
add my kudos to you and Ranking Member Sarbanes for the care- 
ful, thoughtful, and thorough way these hearings are being con- 
ducted on one of the most important pieces of legislation that will 
be before us, the FCRA. 

I think of all the hearings we have had, this one may be the most 
important, at least in terms of its impact on the average person’s 
life, and that is the accuracy of the information in his or her credit 
report. Our laws and principles make it clear that the reporting 
agencies have a responsibility to maintain accurate information. 
And on top of this obligation, there is the pressure of the market. 
Companies want accurate information. They do not want it to be 
too high or too low. It does not lead to their best economic interest. 

But as Senator Allard mentioned, there is an additional check 
and balance that we must have in the system. Consumers should 
have a right to review their credit information and the right to 
have that information corrected when it needs to be. After all, they 
have the most at stake from inaccurate information, and we have 
found that in our financial systems, when there is transparency, 
the opportunity for abuse is lower. And that is why Senator Allard 
and I introduced this week legislation that will provide our na- 
tional credit system with more transparency. Our bill is called 
S. 1370, the Consumer Credit Score Disclosure Act of 2003. Hope- 
fully we can add it to FCRA at some point and not move it along 
separately. But whatever the Chairman would please — I think I 
speak for Wayne, as well — would be fine with us. 

Let me just give my colleagues a little bit of detail about this, 
and I will be quick. 
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Right now, people get a credit report, and it is a complex for- 
mula, but it is the credit score that matters most. The score deter- 
mines whether a loan is made and at what rate. Often, people only 
know the number of their score. They do not know the factors that 
went into the number, how different information in their credit re- 
port was weighed. It is like a black box. And the stakes are very 
high here. Nearly 80 percent of all mortgage lending decisions now 
use credit scores. Specifically, lenders use the score to determine 
whether to extend a loan to an applicant and to make pricing deci- 
sions regarding the terms of the loan. For most families, we all 
know buying a home is the biggest financial move they make. 
Credit score, the principal factor in determining the creditworthi- 
ness and loan terms, is shrouded in mystery, and the simple pur- 
pose of our legislation is to lift the veil of secrecy. 

There is a huge difference. Let me take an example, a modest 
Syracuse mortgage of $80,000. If you shave three points from that 
loan, it would save the homeowner about $140 a month, $1,600 a 
year. And so if the credit score is wrong, people pay for 15, 20 , or 
30 years, depending on the term of their mortgage. And up until 
this year, even the outline of how these scores, mysterious scores, 
have been determined was kept a secret. In fact, most consumers, 
for instance, have no idea that having a whole lot of credit cards, 
even if you pay every one on time, lowers your credit score. Well, 
if consumers knew this was part of the credit score, they could 
make a decision whether they wanted to have that fifth, seventh, 
or tenth credit card. 

So things are beginning to move into the right direction. E- 
LOAN, one company, is offering a free Web-based service that 
allows real estate agents, bankers, and consumers to instantly de- 
termine the credit rating. But we think this should be available for 
everybody. And I hope that our colleagues will pay some attention 
to this legislation as we move it along. It requires lenders to supply 
consumers with their credit score and an invoice that describes 
how it was calculated, the source of who calculated the score, and 
the four factors negatively affecting the score. It is simple Adam 
Smith free market disclosure, and it is something we would like to 
discuss. Senator Allard, and I would like to discuss as we move this 
bill along. 

Thank you. 

Chairman Shelby. Thank you. Senator Schumer. 

Our first panel will just be one gentleman. Mr. Timothy Muris, 
he is the Chairman of the Federal Trade Commission. 

We welcome you to the Committee. We appreciate your indul- 
gence through our opening statements. Your written statement will 
be made part of the record in its entirety, without objection. You 
may proceed as you wish. 

STATEMENT OF TIMOTHY J. MURIS 
CHAIRMAN, U.S. FEDERAL TRADE COMMISSION 

Chairman MURIS. Thank you very much, Mr. Chairman. I want 
to thank you for holding this important hearing, and I particularly 
want to thank you and your staff for working so closely with us. 
I know, as has been mentioned, the Director of the FTC’s Bureau 
of Consumer Protection, Howard Beales has testified before the 
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Committee, and it is a particular pleasure since your Staff Direc- 
tor, Kathy Casey, is a former student of mine. And it has heen a 
pleasure to see her and her staff’s professionalism and skill in 
working through this process. 

Chairman Shelby. You taught her well. 

Chairman MURIS. Thank you. I am not sure she will agree with 
that, but that is another subject. 

As we testified — Howard presented the Commission’s testimony 
in May — the statute, the FCRA, has been a remarkably effective 
law. It helps make possible what I call the miracle of instant cred- 
it, which occurs all over America every day. 

For example, you can walk into a car dealership, and if you have 
good credit, in less than an hour you can borrow $10,000 from a 
complete stranger, or more, and drive out with a new car, which, 
when you think about it, I think is really a remarkable fact. And 
it exists really only in the United States. 

In the over 30 years since the FCRA was enacted, with the lead- 
ership of this Committee and Senator Proxmire, consumer credit 
has expanded exponentially. It accounts for over two-thirds of our 
Nation’s GDP. It has been particularly important, this expansion of 
credit, for the least affluent Americans. Thirty years ago, for exam- 
ple, 5 percent of low- and moderate-income Americans had credit 
cards. Today, half have those cards, nearly half. The FCRA has fa- 
cilitated this growth while at the same time protecting sensitive fi- 
nancial data. 

The FTC supports the package of proposed legislation that the 
Administration and Secretary Snow announced on June 30. We be- 
lieve these proposals, along with a couple of additional ones in our 
testimony, will help improve credit report accuracy and fight iden- 
tity theft, while preserving the benefits to consumers of the na- 
tional credit reporting system. 

To begin, the Commission recommends that Congress renew the 
uniform national standards in Section 624 of the FCRA. The na- 
tional character of our credit markets is a powerful argument for 
retaining these standards. This is not to say that the FCRA is per- 
fect, but any improvement should be made by changes to the na- 
tional standard and not through a patchwork of different State 
laws. 

The changes we support focus on getting more credit reports in 
consumers’ hands, streamlining the dispute process, detecting and 
preventing identity theft, and easing the burden on identity theft 
victims. 

Turning more specifically to accuracy, we have several proposals 
that I believe will enhance the accuracy of credit reports. One pro- 
posal that I believe is particularly important is our recommenda- 
tion to expand adverse action notices to consumers, and it builds 
on your charts, Mr. Chairman. A key element of the FCRA’s protec- 
tion of consumers is the requirement that when credit, insurance, 
employment, or other benefits are denied, based even in part on a 
credit report, the creditor must notify the consumers of their rights 
to a free copy of the report and to dispute the accuracy of informa- 
tion in the report. 

This self-help mechanism is a critical component in an effort to 
maximize the accuracy of consumer reports, and it is a quite inge- 
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nious part of this statute. It puts credit reports in consumers’ 
hands when they are the most motivated to inspect their report for 
inaccuracies — that is, after they have been denied benefits based on 
the report. 

We are vigorously enforcing FCRA’s adverse action provisions 
through industry compliance sweeps and enforcement actions 
against users of credit reports. Nonetheless, this is an area where 
we believe an important improvement is needed in the statute. 

The FCRA generally requires an adverse action notice when a 
consumer is offered less advantageous terms because of his credit 
report with respect to credit offers. But if the consumer is offered 
and accepts those less advantageous terms, he gets no adverse ac- 
tion notice. 

Now, in the modern world, this counteroffer exception makes no 
sense. Ten years ago, credit decisions were usually pass-fail. You 
either got the credit you applied for or were rejected. Today, with 
the prevalence of risk-based pricing, which was your point, Mr. 
Chairman, consumers more often are offered a higher rate or worse 
terms. Those consumers may pay for a loan or credit card based on 
inaccurate information in their credit report, but they will never 
learn about it. This gap frustrates achievement of the FCRA’s basic 
consumer protection goals. For this reason, we recommend that 
Congress give the FTC rulemaking power to expand the cir- 
cumstances under which consumers get adverse action notices. 

Again, it is crucial to the working of the system that consumers 
be notified when there is a problem in their credit report. For most 
consumers, most of the time, it is not worth their time to go read 
their credit reports. They have a lot of busy things to do in life. An 
ingenious part of the system is you are notified when you are de- 
nied a benefit because of what is in the report. But because of 
changes since the law was enacted with this risk-based pricing, 
there is now a significant loophole which we think should be closed. 

We also have recommendations that will make it easier for con- 
sumers to dispute inaccurate information. For example, there is an 
anomaly in the law whereby resellers of consumer reports are re- 
sponsible for investigating consumer disputes. We think that the 
credit repositories should share some of that burden. In addition, 
we recommend amendments that would make it harder for fur- 
nishers to reintroduce fraudulent information in the credit reports. 

Finally, we believe the law should be amended to require fur- 
nishers of information to investigate consumer disputes when con- 
sumers contact them directly. Consumers do not Imow necessarily 
that under current law they are supposed to contact the credit re- 
porting agency. We see no reason why, when they contact the fur- 
nisher, that should not trigger the reinvestigation requirement. 

It is a pleasure to be here, and I will be happy to respond to any 
of your questions about our recommendations or any of the other 
issues. 

Thank you. 

Chairman Shelby. Thank you. Chairman Muris. 

The very first section of the Fair Credit Reporting Act highlights 
the importance of the accuracy of credit reports that we have been 
talking about today. Let me just briefly quote from the law. “Inac- 
curate credit reports directly impair the efficiency of the banking 
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system.” It might be fitting, Mr. Chairman, to expand that sen- 
tence so that it reads, “Inaccurate credit reports directly impair the 
efficiency of our whole economy.” 

Chairman MURIS. I certainly think that one of the reasons that 
our economy is so strong, particularly compared to the rest of the 
world, is the flexibility of our credit system. 

Chairman Shelby. Absolutely. 

Chairman Mums. And that credit system relies on these national 
credit standards, and this law is essential, I think, to making those 
standards work. 

Chairman Shelby. Would you agree that inaccuracy in credit re- 
port information could create inefficiencies in the economy? 

Chairman MURIS. Absolutely. And I certainly agree with the 
comments that others are making, you know, that not all inaccura- 
cies are created equal. 

Chairman Shelby. Sure. 

Chairman MURIS. But, again, that is why it is so important to 
put this information in the hands of consumers. 

Chairman Shelby. What is your understanding, Mr. Chairman, 
as to the level of inaccuracy found in credit reports? 

Chairman MuRis. We have no way of knowing the precise level 
of inaccuracy. Again, the ingenious nature of this system and why 
we want to expand the adverse action notices is that when you are 
denied a benefit because of what is in the credit report, you need 
to be told. And that puts you on notice, particularly if you think 
there must be a mistake, to see what the problem is. 

The statute obviously understands that you are dealing with 
something like, with these big credit bureaus, 2 billion transactions 
a month. Perfect accuracy is neither possible nor desirable. 

Chairman Shelby. But accuracy is very desirable, maybe not 
perfect. 

Chairman MuRis. Absolutely. That is why we take lots of steps 
to deal with accuracy, and that is why we think, although you 
should extend the preemptions in the national system, that you 
should improve the statute, particularly in terms of accuracy. 

Chairman Shelby. A lot of things that Senators Corzine, Crapo, 
Allard, Schumer, and others have been talking about as far as ac- 
curacy, is putting together a comprehensive bill here which could 
improve the accuracy and the efficiency of credit reporting, could 
it not? 

Chairman MuRis. Absolutely, and that is what our package of 
proposals is aimed for. We look forward to working with you on de- 
veloping such a package. 

Chairman Shelby. You do not have a specific number, you know, 
statistically, as to the errors. Is there any way to get a specific 
number? Because numbers do matter. 

Chairman MURIS. Well, they do matter. I am not sure that it is 
worth the cost of getting a specific number. I do think that easing 
the ability of consumers to have the information is the best route 
to take, and that is why we made several proposals, including free 
credit reports 

Chairman Shelby. That would be good for the consumer by a 
long way, but also good for business, would it not? 
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Chairman MuRis. Well, yes. I do think that a more accurate sys- 
tem, assuming it can be achieved without undue cost, would be bet- 
ter. And I think the proposals that we have made take us a signifi- 
cant way down that road. 

Chairman Shelby. Mr. Chairman, do you think that the Federal 
Trade Commission should have a responsibility to obtain informa- 
tion regarding the accuracy of the information contained in con- 
sumer reports on an ongoing basis? 

Chairman MURIS. I would be particularly concerned — and I know 
there is a provision in the House bill — if we were asked to spend 
a lot of resources trying to come up with, trying to determine what 
the level of accuracy is. I think our resources would be better spent 
on consumer education, on developing new laws such as we have 
talked about, on enforcement, because — although, again, accuracy 
is a key to this statute, but trying to find out and deal with some 
of the issues that people have raised here about accuracy, I am not 
sure that is the best 

Chairman Shelby. Well, accuracy is going at the truth of what- 
ever the information is. 

Chairman MURIS. Yes, that is certainly true. But I think Senator 
Bennett’s point about levels of accuracy is very well taken. 

Chairman Shelby. Absolutely. Does the Federal Trade Commis- 
sion, currently have the authority and the resources necessary to 
ensure that the highest level of accuracy possible is achieved? Do 
you need more resources? Or do you think, as you alluded to, you 
are going to work with us toward better legislation? 

Chairman MuRis. I think the preferable route is better legisla- 
tion. We received our mark from the House appropriators yester- 
day. If we get that amount of money from the Senate, I think we 
can very admirably carry out our responsibilities, including what- 
ever new responsibilities you would give us. 

Chairman Shelby. Especially if we put together a good bill over- 
all, one that is good for business, good for the economy, and good 
for the consumer? 

Chairman MuRis. Yes, sir, absolutely. 

Chairman Shelby. Senator Sarbanes. 

Senator Sarbanes. Thank you very much, Mr. Chairman. 

Chairman Muris, I am going to try to run through some ques- 
tions with you very quickly. As you know, our time for questioning 
is limited. But, first, I do want to note the front-page article in to- 
day’s New York Times on the FTC’s Do Not Call Registry. This ar- 
ticle says that there has been an outpouring of public interest in 
the registry far exceeding the Government’s initial expectation. Ac- 
cording to the article, Americans have submitted 23 million phone 
numbers in the last 2 weeks for the registry, and the FTC expects 
at least 60 million Americans to sign up by October 1. 

What does this tell you about the way people are feeling about 
the invasions of their privacy? 

Chairman MuRis. Well, I think the reason that we have adopted 
the national Do Not Call Registry is in response to concerns over 
privacy. And, indeed, the reason that we are making several pro- 
posals here is in response to concerns about privacy. 

I am not sure that it is accurate that we have received a lot more 
initial sign-ups than we expected. We thought this would be a very 
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popular initiative. The Commission has never received anything 
like the comments and the response in its history to anything we 
have done like the Do Not Call Initiative. 

I do think people care about privacy, and what they care about, 
I think, is when their information is misused in ways that bother 
them. And the interruption of their dinnertime is a perfect exam- 
ple, and I also think, to transfer that to this context, when sen- 
sitive information is misused or it is inaccurate, those are the kinds 
of things that bother people the most rather than abstract notions 
of, you know, privacy. I think people are very practical, and when 
it is misused and causes them consequences, that is when they 
really care. And I think Do Not Call demonstrates that. 

Senator Sarbanes. One of the witnesses on the next panel, Mr. 
Brobeck, from the Consumer Federation, recommends broadening 
the Federal enforcement of FCRA in two ways. He recommended, 
“An appropriate Federal Agency such as the FTC should audit the 
repositories’ records on a regular basis to identify data furnishers 
who report incomplete or incorrect information to the repositories.” 
He also recommended that the FTC should collect and analyze in- 
formation about credit reporting disputes on a quarterly basis and 
report this information to Congress annually. 

Would you support those recommendations? 

Chairman MuRis. Well, I have welcomed our cooperation and 
support on many issues from the consumer movement and the CFA 
in the past. I have trouble with some of their recommendations 
here. The idea of an audit bothers me in the following sense. I 
think we need to focus on the key trigger point of the statute, 
which is letting consumers know when there is a problem. I think 
in terms of furnishers, it is a voluntary system. We have sued fur- 
nishers for supplying inaccurate information. There are duties 
dealing with furnishers. In fact, we are proposing to trigger the re- 
investigation process, as I mentioned, when a consumer contacts 
the furnisher. 

So, I think there are some more things that furnishers can do. 
There are already duties on furnishers. But I am concerned about 
shifting our focus from the consumer and the consumer getting no- 
tified to a more abstract idea of auditing and studying the proce- 
dures of the credit reporting agencies. 

Senator Sarbanes. You used the instant credit example in your 
own statement. Does the store receive a complete credit report, or 
does it simply receive a credit score when it acts in that instance? 

Chairman MuRis. Well, I think it depends. In the case of the real 
instant credit, they are receiving often just an approval. I am not 
even sure 

Senator Sarbanes. And if the consumer is denied credit in the 
instant credit scenario and then requests a credit report as a result 
of that adverse action, what would the credit reporting agency pro- 
vide to the consumer? Just what the store got? 

Chairman MURIS. My understanding is no. Well, I am not sure 
what the store gets, and 

Senator Sarbanes. Well, shouldn’t the consumer 

Chairman MuRis. Yes, I agree the consumer should get the 
full 
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Senator Sarbanes. Shouldn’t the consumer, at least, get what 
the store got? And if that is not the full report, probably get the 
full report as well, should he not? 

Chairman MuRis. Absolutely. I agree. Senator. What they are 
supposed to get now, this is triggered by the so-called Equal Credit 
Opportunity Act notice. They are supposed to be told the four lead- 
ing reasons why there was a problem with their credit report. 

I agree that just giving them a very simple piece of information 
would not be useful, but I believe under current law they are re- 
quired to get more than that. 

Senator Sarbanes. My time is up. Let me just ask you, is it the 
intention of the FTC to provide to the Committee draft statutory 
language to carry out the recommendations that you have pre- 
sented to us in your statement here this morning? 

Chairman MuRis. Yes, sir. 

Senator Sarbanes. And how promptly can you do that? 

Chairman MuRis. Well, we have been working with the Com- 
mittee, and I think we would be able to do this very promptly. And 
we have been working with the other body as well. 

Senator Sarbanes. What is “very promptly?” 

[Laughter.] 

Chairman MuRis. Well, I am not even sure what day of the week 
it is. It is Thursday, I think. I would be very surprised if we cannot 
sit down and do something — next week? 

I am checking with the people who have to do the work before 
I make a promise. 

Yes, next week would not be a problem at all. 

Senator Sarbanes. Thank you, Mr. Chairman. 

Chairman Shelby. Senator Dole. 

Senator Dole. Mr. Chairman, as an alumnus of the FTC, I take 
a great deal of interest in your testimony, which I find very cred- 
ible, because I know that these recommendations represent a bipar- 
tisan consensus approach. 

Now, currently, the Federal Trade Commission has four Commis- 
sioners appointed by President Clinton, and then you, an appoint- 
ment of President Bush. Isn’t that correct? 

Chairman MuRis. Yes, Senator. 

Senator Dole. You are clear in your testimony the FTC supports 
the permanent reauthorization of the Fair Credit Reporting Act 
preemptions contained in the 1996 Act with some modest amend- 
ments. Is this the unanimous position of all the Commissioners? 

Chairman MuRis. Yes, it is. 

Senator Dole. Mr. Chairman, do you agree with the statement 
of Director Beales who stated earlier that affiliate sharing assists 
in the prevention of identity theft? 

Chairman MURIS. Yes. Yes, I think that it is important that fi- 
nancial institutions have access to more information than the 
crooks have to stop the fraud. And in that sense, I think the infor- 
mation is helpful. 

Senator Dole. Inasmuch as affiliate sharing prevents identity 
theft, would you agree, then, that affiliate sharing leads to more 
accurate credit reports? 

Chairman MuRis. Yes, I would, and we do support it and think 
that affiliate sharing is an important part of this process. 
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Senator Dole. And while there is always room for improvement, 
do you believe that the credit reporting agencies are doing enough 
to ensure accurate credit reports? 

Chairman MuRis. We have had several opportunities to engage 
in enforcement against the credit reporting agencies. That process 
continues. We are their primary regulator. I think, you know, with 
a rare misstep, which I think we have corrected, I think that they 
have done a good job. 

I do believe that some additional legislative protections, particu- 
larly in terms of accuracy, which I have outlined, would be helpful. 

Senator Dole. In your prepared statement, you give the example 
that if States are able to pass differing laws on reinvestigation 
times, furnishers might determine that their reinvestigation duties 
are too onerous and simply exit the system. Do you believe the 30- 
day period in the Fair Credit Reporting Act is the appropriate one? 

Chairman MuRis. Well, Senator, I do think the 30 days has 
worked well, and I think there are a couple of important points to 
make. The one that you are referring to about the voluntary nature 
of the system and the furnishers’ cooperation is very important. 
And a second point is we have frequently brought cases against 
scams that involve credit repair. And one of the things that some 
of these scams tell you to do is to challenge everything, ask for a 
reinvestigation on everything, with the idea that maybe you can 
run out the clock. And if the period was shortened particularly dra- 
matically — I know some people have proposed 15 days — I think 
that would be a serious problem in terms of these scams. 

Senator Dole. You also give an example in your prepared state- 
ment as to the problems that may arise from shorter obsolescence 
periods governing how long negative information can continue to be 
reported. Do you believe the 7-year period included in the Fair 
Credit Reporting Act is the appropriate time period? 

Chairman MuRis. Well, I think the 7 years has worked well. I 
have seen no reasons at all to change, and that is the basis of our 
recommendation. 

Senator Dole. Senator Dodd sent me a copy of a series of articles 
that were written in the Hartford Courant, and this detailed some 
very distressing charges of errors the paper says have been built 
into the credit reporting system. One such charge was that credit 
reporting agencies have the incentive to put false information in a 
credit report because the potential creditor is more likely to buy a 
report with more information in it because they assume that it 
must be more accurate. 

I find this hard to believe. Would you comment on that charge? 

Chairman MuRis. I find that very hard to believe as well Sen- 
ator, and I am not aware of any evidence that this has occurred. 
The credit bureaus are in the business of selling not only informa- 
tion, but also accurate information, and that is why I am surprised 
by that allegation. 

Senator Dole. In your written testimony, you state that, 
“Prescreened offers provide many benefits for consumers, and can 
enhance competition, leading to greater credit availability, better 
terms, and lower costs for consumers.” Some of the witnesses in 
previous hearings have stated that prescreened offers have one of 
the lowest rates of fraud. Do you agree with this observation? 
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Chairman MURIS. I do not think that there are systematic prob- 
lems in terms of fraud with prescreened offers. I have seen evi- 
dence certainly consistent with the statement that you are making. 
I think the prescreened system has worked well. I do think that 
giving us the ability to make the opt out more prominent and easi- 
er for consumers to use would be a useful thing, and that is why 
we have recommended that. 

Senator Dole. And I just want to make it clear for the record. 
All of the Commissioners at the Federal Trade Commission support 
the continuation of the prescreening preemption, of course, with 
better disclosure for the opt out. 

Chairman MuRis. Yes, yes. 

Senator Dole. What can Congress do to improve the accuracy of 
information in credit reports? 

Chairman MURIS. I do think it would be helpful to implement the 
proposals that we made. We do not have a monopoly on the best 
way to approach this, of course, and I am certainly looking forward 
to working with you. 

And I just want to add on a personal note that it is a pleasure 
to be working with you again after all these years. The years have 
treated me a little worse than they have treated you, but it is a 
pleasure to be working with you again. Senator. 

Senator Dole. Thanks very much. 

My time has expired. Thank you, Mr. Chairman. 

Chairman Shelby. Senator Corzine. 

Senator Corzine. Thank you, Mr. Chairman. 

I do not really know how to follow that up. 

[Laughter.] 

Let me see. The idea that you are going to give an opportunity 
for a consumer who has an adverse notice is the major response 
that you are suggesting — do I hear this correctly — with regard to 
making sure that consumers are aware of deterioration in their 
credit? 

Chairman MURIS. I think the key to the system that Senator 
Proxmire set up is that the consumers are put on notice when 
there is a problem, when they are denied a benefit because of 
something in their credit report, and I think we can improve that 
system. 

Senator Corzine. But you are suggesting at the point of a trans- 
action, being turned down? 

Chairman MURIS. I think that for most consumers, that is when 
they would care. Now, I do think that there are several things that 
we propose that — if a consumer is really interested in the absence 
of a transaction, I think we should make it easier for them to get 
the information about their credit report and about how the system 
works, and 

Senator Corzine. Secretary Snow’s once-a-year credit report and 
the detail in the way that Senator Sarbanes and others were talk- 
ing about — information that might have changed from year to year, 
or adverse factors, so that individuals would know when they are 
going to change jobs that they may have adverse information in a 
credit report, or if they are contemplating buying a car, they know 
that they are going to get a lower credit score. I am presuming you 
are incorporating the once-a-year 
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Chairman MuRis. Yes, sir. 

Senator Corzine. And for the record, that is part of your rec- 
ommendations, not just a notification of an adverse factor at the 
time of 

Chairman MuRis. Oh, absolutely. We are proposing that they be 
able to get the one free consumer report. We are proposing that 
consumers have the option of receiving more information. 

Now, I think it is important to add that it needs to be up to the 
consumer. We are certainly not proposing a blanket mailing to ev- 
eryone of their consumer report. I am not suggesting, and we do 
not suggest, that everybody needs to look at their consumer report 
on a routine basis. That should be up to the individual. 

Senator Corzine. I just — and I guess this is a basic philosophy 
issue — but an individual who is in contemplation of buying a car, 
in contemplation of taking out a mortgage, or accessing credit may 
be already dependent on having that transaction take place, and if 
they are not aware of deterioration in their credit, there can be se- 
rious circumstances that are attributed to it. So, I am a little trou- 
bled with that tension. 

Chairman MuRis. Well, I am not sure that there is a tension. It 
is really up to the individual. If the individual is particularly risk- 
averse, or if they have some reason to believe there is a problem, 
we think it should be easier than it is now for them to investigate. 

On the other hand, I do not think — for a lot of people who have 
not had any problems in their lives, they have a lot of things to 
do with their lives, and I am not going to recommend to such a per- 
son that they spend their precious time reading and investigating 
their credit. But we want to make it easier for the individual, and 
we particularly want to make it easier at that crucial time if you 
are denied a benefit to get the information. 

Senator Corzine. One specific on that. I do not know if other 
Senators feel this way, but I would like to understand in practical 
terms, if you request a credit report on yourself, what that would 
look like. What would the requirements actually be that would be 
sent out by one of the reporting agencies so that the practical ele- 
ments of it are actually what we are talking about? 

Chairman MuRis. Yes, that is an excellent question. Right now, 
in some States, you can get them for free, and in other places, you 
can buy them. We would be glad to work with you and show you 
how that works. 

Senator Corzine. I find it troubling that you have to buy them. 

Chairman MURIS. And that is one of the reasons that, under our 
recommendation, that would no longer be true. 

Senator Corzine. I think that under Secretary Snow’s, if individ- 
uals knew they had the availability, they would put in an annual 
request. 

Chairman MuRis. Well, in the States, again, it depends on the 
consumer. In six States, they have that right, and more exercise 
the right than if they had to pay for the report, but obviously, it 
takes some time to digest and understand, and for some people, 
that might not be worth their time, and I can understand that. 

Senator Corzine. Three other points, quickly. First, I think that 
you just gave an absolute recommendation of financial literacy ties 
to this. 
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Chairman MuRis. Oh, absolutely. 

Senator Corzine. That, without education, these things are 

Chairman Shelby. Senator Corzine, our next hearing is going to 
dwell on financial literacy. 

Senator Corzine. Second, I think the identity theft issue makes 
this even more important. Once you have been invaded as an indi- 
vidual, the idea of whether this thing gets cleaned up on an accu- 
racy basis is one of the reasons we are introducing the nature of 
the legislation, but I again go back to this comprehensive nature. 

And finally, I am really struck with the range of statistical vari- 
ation that Senator Bennett talked about and others recognized, and 
I am not sure that I agree that it is not worth the cost of having 
some kind of understanding of what the nature of the problems 
are. Even though it is a big and complicated system, having some 
readout on the nature and the gradation of the nature of the prob- 
lems — is it an “S” or an “F” or is it the kinds of things that come 
with identity theft. I am a little troubled that we make policy deci- 
sions when we are not sure what the nature of the problem is be- 
cause we are not accumulating all the data. 

So, I will ask a simple question and then I will shut up. What 
is the range? Are we closer to 0.2 percent, or 29 percent, or 0.70 
percent? 

Senator Bennett. Not “point” — 70 percent. 

Senator Corzine. Yes, yes. Excuse me. 

Chairman MURIS. I will say this — that the studies with the high- 
er numbers, I believe their methodology is seriously flawed. I would 
be very surprised — and I do not know as much about the method- 
ology of the 0.2. The question which Senator Bennett’s “F” and “S” 
illustrates is the significance of the benefits, which is again why I 
think it is so important to expand the adverse action notice, and 
for those consumers who want, even outside the context of a par- 
ticular transaction, to look at their credit report and understand 
the system. I think we should increase that availability as well. 

Senator Corzine. Thank you. 

Chairman Shelby. Thank you. Senator Corzine. 

Senator Bennett. 

Senator Bennett. Thank you very much, Mr. Chairman. 

Chairman Muris, have you or your staff looked into two issues 
with respect to the free credit report — and let me say right up front 
that I applaud the idea that someone should be able to access their 
report at their own instigation, not only when there is a notice of 
an adverse action — but have you looked at two aspects of providing 
the free report — number one, the cost, and number two, the oppor- 
tunity for identity theft. 

Let me tell you what I mean on the second one. We had, at our 
last hearing, a passionate appeal for Congress to do something — 
I am not quite sure what we could do — about “dumpster diving.” 

During the hearings on identity theft that I held when I was 
Chairman of the Subcommittee that dealt with this, we were told 
that one of the standard ways of people who went after identity 
theft in a serious fashion was to steal mail. They would hope they 
would find in the mail a credit card. If they did not find in the mail 
a credit card, they would hope they would find a bank statement 
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or some other document that would give them information about 
some individual whose identity they could then steal. 

Isn’t there a possibility that some clever criminal listens to all 
this and says, “Boy, this is terrific; I am going to request the free 
credit report for Robert S. Bennett” 

Senator Schumer. How about Robert F. Bennett? 

Senator Bennett. — I will do that, too, and I will do Charles 
Schumer, and I will do John Corzine and all the rest of it — and see 
what I get, and particularly if there is a flood of these coming in, 
and you talk about errors, and a flood of mail coming back, is there 
a possibility that in our effort to prevent identity theft, we facili- 
tate it? 

Chairman MuRis. Well, a couple of responses to that, and par- 
ticularly to the last point. The CRA’s right now require various 
steps to make sure it is the right person. If you are a successful 
criminal, if this tactic really worked, I am not sure the $9 that it 
costs now would be much of a deterrent. Obviously, it is $9 more 
than free. 

Senator Bennett. I will get back to cost in a minute. I am not 
talking about the cost right now. 

Chairman MURIS. No. But I am saying that if this is a way to 
engage in identity theft, you can do it now for $9 per credit report. 

Senator Bennett. I see. 

Chairman MURIS. I do think that identity theft is a serious prob- 
lem — a very serious problem. I know that you had a hearing on it; 
FTC Bureau of Consumer Protection Director Howard Beales testi- 
fied. Many of our proposals deal with identity theft. We are going 
to release a survey sometime this summer about the incidence of 
identity theft, and we are still trying to digest those numbers now. 
But I do not think this proposal, based on the experience that we 
have seen just in the small number of States that allow free re- 
ports and the experience with the $9 now, has been a major source 
of identity theft. 

Senator Bennett. Okay. I have discussed this with the industry, 
and they tell me that if the request is made online — if this is an 
Internet request — they are almost certain that they can prevent 
anybody from requesting this information. If it is mailed out, they 
say the chance of somebody getting the information and using it 
improperly is substantially better. 

So, I would like to pursue in the legislation, Mr. Chairman, the 
whole question of how the report — if we are indeed going to see a 
significant rise in requests for reports — is formed. I do not know if 
we can absolutely insist that it always be an electronic request and 
an electronic response, but that, I am told, is far more secure than 
responding in the mail. 

Now, back to this issue of cost. I am not talking about the cost 
to the consumer. I am talking about the cost to the credit bureau. 

Chairman MURIS. I understand. 

Senator Bennett. And the question arises — do we have any sta- 
tistics as to how more requests they will get, how much additional 
costs they will incur, and life being what it is, therefore, costs that 
will be ultimately passed on to the consumer? 

Chairman MuRis. You are absolutely correct that the costs will 
be passed on. From various parts of the industry, I have heard two 
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different estimates of the costs in the handful of States that allow 
it now. One is that not very many more people requested free re- 
ports. Another is that a significant increase off a very small base 
requested reports. And I do think it is important — and this may be 
somewhat of a tension in the previous questions — I personally 
would oppose something that really pushed people to look at their 
credit reports unless they had some reason — if they were very risk- 
averse, were about to enter an important transaction, or they had 
some particular suspicion about their report. 

Most people do not look at their credit reports. Most people have 
good credit. I think it should obviously be the choice of the con- 
sumer, but we should not encourage or frighten people to do some- 
thing that is not necessarily in their interest. 

Senator Bennett. Thank you. 

Thank you, Mr. Chairman. 

Chairman Shelby. Senator Schumer. 

Senator Schumer. Thank you, Mr. Chairman. 

I want to thank you, Mr. Muris, for always being available to 
this Committee and for your forthright answers. 

I would like to focus on the legislation that Senator Allard and 
I talked about earlier today. First — and I know you have not seen 
it; we just dropped it in yesterday, so you probably have not seen 
the details — but what do you think of the general concept? 

Chairman MURIS. We support the concept of giving people infor- 
mation, the right to a free credit report, information on how the 
credit scoring system works, certainly having a credit score. I think 
it is important to understand there is no one “the credit score,” so 
I am hoping you have some flexibility. 

I am a little bit concerned — we do antitrust and competition — 
this is an industry with not very many players, and I would not 
want to do anything inadvertently that gave one player an advan- 
tage. I do not think you would do this or are proposing to do this, 
but if somebody wanted to say one kind of credit score was more 
preferable than another, that would cause us problems. 

Senator Schumer. But all we do is allow people to see how they 
got the credit score from that particular agency. It is obviously the 
bank or whoever is hiring the company that is going to 

Chairman MURIS. Sure. That is fine. 

Senator Schumer. We do not want to determine what the credit 
score should be. 

Chairman MURIS. But there are different kinds of credit scores. 
That is all I am saying. 

Senator Schumer. No question, no question. But we are not 
going to mandate how you create a credit score. We just want peo- 
ple to know — right now, they give you your score, and that is it. 
So it is like saying you flunked, or you got a “D,” or you got a “B,” 
and you ask which questions did I get right, and which questions 
did I get wrong, and they say, “We cannot tell you.” That is the 
frustration that people feel. 

Chairman MURIS. Yes. You can certainly get more detailed infor- 
mation in terms of adverse actions already now, but we think that 
that should be available more widely; it should be available with- 
out cost, and if that is the concept of your bill, then that is cer- 
tainly completely consistent with what we are proposing. 
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Senator Schumer. Well, I had a lot of other questions in case 
you said “No,” hut you said “Yes,” so I will yield back my time. I 
know we have a vote, so my colleague can proceed. 

Chairman Shelby. Senator Allard. 

Senator Allard. Thank you. 

I want to delve a little bit into enforcement. Sometimes constitu- 
ents have contacted me when they have had problems with juris- 
dictional issues concerning the enforcement of fraud. For example, 
the victim may live in one State, and the act occurred at a retail 
store in another State, and both enforcement agencies say it is the 
others’ responsibility. 

My question to you is what enforcement actions are at your dis- 
posal, and how often have you exercised that authority? 

Chairman MURIS. Well, we certainly engage in a wide variety of 
enforcement, and we have enforcement, obviously, interstate, and 
when it comes to fraud, that is particularly the mainstay of what 
we do. 

Because more and more problems are international, and we have 
a proposal before the Congress, which has passed the Commerce 
Committee as part of the FTC reauthorization, to approve our abil- 
ity to deal with cross-border fraud. 

In terms of the credit reporting agencies, we are their primary 
regulator and, as I have mentioned, from time to time over the 
years, we have brought cases against them, including very recently. 

Senator Allard. How would you bring a case against a reporting 
agency, because this is an enforcement problem. It may come to 
light because it went through the Agency, so the Agency tells you 
to contact the local law enforcement in each State. When the State 
refuses to take action — what alternative does that individual have? 

Chairman MuRis. One of the ways which we have recently — and 
this is still an ongoing issue in some ways — dealt with the credit 
reporting agencies is making sure that they are answering the 
phones. They are supposed to have a process that consumers can 
reasonably use to deal with problems on their credit report. 

Obviously, if you are talking about some kind of fraud or problem 
with a credit card company, or if there is a dispute about a bill, 
that is not the responsibility of the credit reporting agencies. We 
also enforce the Fair Credit Billing Act, which provides procedures 
for dealing with those disputes. 

In terms of fraud, I mentioned with Senator Dole the credit re- 
pair scams. We have brought a large number of those cases. We 
have recently seen people — ^you know, when money is involved and 
financial information is involved, there is a lot of opportunity for 
scams. There are people online right now who are scamming peo- 
ple, trying to get sensitive information from them, and it is to mis- 
use the information, and we have a lot of those investigations and 
have brought a lot of those cases. 

Senator Allard. So you have the capability to investigate and to 
prosecute? 

Chairman MuRis. Absolutely. 

Senator Allard. How often have you exercised that authority? 

Chairman MURIS. Let me just give you one statistic. In terms of 
telemarketing fraud, for example — we were talking about the tele- 
marketing issue — between the FTC and the States in the 8 years 
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or so of the Telemarketing Sales Rule, there have heen over 1,000 
cases. When consumers are ripped off — and fraud is the worst ex- 
ample — that is the mainstay of what we do, and many more of our 
resources go there than anyplace else. 

Senator Allard. One other question just to follow up on Senator 
Schumer’s line of questioning — he did not ask if you believe that 
the credit scores should he provided free of charge? 

Chairman MuRis. Yes, yes. Again, it is not just the score, but we 
believe that people should be able to get their report, they should 
be able to get an explanation 

Senator Allard. What goes into it, right. 

Chairman MURIS. Right, how the system works. 

Senator Allard. Do you think that whole report should be pro- 
vided? 

Chairman MURIS. Right, and I think that is more important, 
quite frankly, than the score itself The steps that you can take to 
improve — these scores can be confusing since different people use 
different systems. 

Senator Allard. Thank you, Mr. Chairman. 

Chairman Shelby. Senator Sununu. 

Senator SUNUNU. Thank you, Mr. Chairman. 

Chairman Muris, I want to talk a little bit more specifically 
about access to free reports, and I apologize for being the last ques- 
tioner, so you might have touched on some of this already. 

Currently, consumers can get access to a free credit report if they 
are denied credit. What is the percentage of consumers that have 
been denied credit who actually take advantage of the opportunity 
for a free report? 

Chairman MURIS. You know, I do not know that number. Even 
my experts do not know that number, but we would be glad to try 
to get you something. 

Chairman Shelby. Can you do that — find out for the record and 
furnish that to us? 

Chairman MuRis. Sure. Yes, sir. 

Senator Sununu. That would be good. It would seem to me to be 
a pretty important figure, especially if ensuring full access for ev- 
eryone to free credit reports is part of the proposal, because if it 
is 10 million people getting free credit reports, and it is costing a 
tremendous amount of money, then obviously, we would want to at 
least give some extra consideration 

Chairman MuRis. The number of people who seek free credit re- 
ports even in areas where they are allowed to get free credit re- 
ports does not appear to be, percentage- wise, a large number. 

Senator Sununu. Which brings me to my next question. There 
are six States that allow that, correct? 

Chairman MURIS. I think that is right. 

Senator Sununu. What are those States, or what is the largest 
of those States, and what are the take-up rates for those States 
that allow free credit reports? 

Chairman MuRis. The more recent evidence that we have re- 
ceived is that people — somewhere around double. It was a fairly 
small number. 
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Georgia, Massachusetts, Colorado, and Vermont, I am told. I re- 
ceived a statistic yesterday it was somewhere in the neighborhood 
of — I think it was Colorado — it was something like 100,000 reports. 

Senator SUNUNU. Okay. I would appreciate it if you could go 
ahead and provide that information for those six States that allow 
full access to credit reports and the number of credit reports that 
are provided to those consumers who do not have a problem. 

Chairman MURIS. Right, and the number that sticks in my head, 
and I think it was for Colorado, even with free reports, was some- 
thing under a couple of hundred thousand a year. 

Senator Bennett. Do you want the numbers? 

Chairman MuRis. Yes. Do you have the numbers? 

Senator Bennett. I have them, yes. 

Chairman MURIS. Okay. 

Senator Bennett. New Jersey, 2.37 percent, which is a 35 per- 
cent increase over the national average of 1.7 percent; Massachu- 
setts, 2.21 percent, a 25 percent increase over the national average; 
Maryland, 5.53 percent, a 204 percent increase over the national 
average — Senator Sarbanes’ constituents are more curious; Geor- 
gia, 6.14 percent, a 250 percent increase over the national average; 
and Colorado, 4.45 percent, or a 153 percent increase over the na- 
tional average. 

So the average increase for all of these States is 144 percent. So 
you are operating off of a small base. The national average is 1.76 
percent, and it goes up to 4 or 5 percent in the highest. 

Senator SUNUNU. And I would simply appreciate it if you could 
verify those numbers, and Mr. Chairman, if we could include the 
numbers in the record 

Chairman Shelby. Absolutely. 

Senator SuNUNU. And I would ask a question of my colleague, 
which is how can there be a national average if there is not a uni- 
form requirement that people have access to their credit reports. 

Senator Bennett. Well, by “national average,” that means the 
national average of people who get reports when there is an ad- 
verse action. 

Senator Sununu. So it is 20, 50, or 250 percent more than the 
percentage that take advantage when there is an adverse action. 

Senator Bennett. That is right. 

Chairman MURIS. And again, the absolute numbers are not very 
large. But one thing that is interesting is I suspect. Senator Ben- 
nett — and I do not know for sure whether we are getting numbers 
from the same sources, and they do not completely agree, but we 
will figure out whatever the discrepancy is. 

Senator Sununu. I would appreciate the best possible numbers 
being provided to the Committee. 

Senator Bennett. These are the numbers from a single credit 
bureau. 

Chairman MuRis. A single credit bureau, okay. We have them 
from the three. 

Senator Sununu. How many of the three major credit bureaus 
provide information about scoring methodology on their credit re- 
ports now? 

Chairman MURIS. I believe that you can get information from all 
of them. 
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Senator SUNUNU. I am sure you can get information from all of 
them 

Chairman Shelby. Do you believe it, or do you know it? 

Senator SuNUNU. — but is it provided 

Chairman Shelby. Will you furnish that for the record? 

Chairman MURIS. Yes. My understanding is that they do that, 
but I will double-check to make sure. 

Senator SUNUNU. And being able to get information if you ask for 
specific information is one thing; being given information in con- 
junction with your credit report is another. 

Chairman MURIS. Correct. And my understanding again is that 
you get that information, but I will verify that. 

Senator SUNUNU. A final question. I think one of the most frus- 
trating that I have seen, both seen personally and heard about, is 
when a consumer addresses a problem in their credit report, a 
piece of inaccurate information, and they deal with this issue, and 
then it comes back, and the next time they are dealing with a cred- 
it report, it is back on there, and then they call and fix it again, 
and then it is back on there again. 

What, if anything, is the FTC doing to try to address or alleviate 
this problem? 

Chairman MuRis. We have taken several steps. There is on occa- 
sion a situation where the consumer and the creditor simply dis- 
agree. There are also private rights of action available, and there 
is something of a cottage industry involved in these sorts of cases. 
But we have, in the aggregate, been worried over the years and 
have taken steps, including suing the companies to make sure that 
their complaint resolution process provides the kinds of reasonable 
procedures that the law requires. 

Senator SUNUNU. Is it your perception that where private right 
of action or other enforcement mechanisms — penalties, fines, what- 
have-you — exist, are they substantive enough and appropriate to 
actually discourage the activity, and if not, where are they short? 

Chairman MuRis. Well, you have two different levels of issues 
here. One is between the consumer and the creditor, and the other 
is the credit reporting agency. In terms of the latter, we are not 
recommending as a Commission, and I certainly would not rec- 
ommend personally, any change in the remedial structure. 

In terms of the former, although I have not focused on it particu- 
larly for this hearing, I am not aware of any systematic problems. 
Obviously, in a system where you have 2 billion transactions a 
month going to the credit reporting agencies, it would be shocking 
if you could not find examples of mistakes, and mistakes that are 
hard to correct. 

I do believe that the incentives of the system are good, and I also 
believe they can be improved some, which is the basis of our rec- 
ommendations. 

Senator SUNUNU. Thank you very much. 

Thank you, Mr. Chairman. 

Chairman Shelby. Thank you. 

Mr. Chairman, maybe I misheard you a few minutes ago. I be- 
lieve you were answering Senator Corzine’s observation or ques- 
tion. But you said you would oppose one — for example, myself — 
wanting to look at my credit report? Did I mishear you? 
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Chairman MURIS. No. What I would oppose is you requiring a 
mass mailing to everyone of their credit reports. 

Chairman Shelby. Oh, okay. I am glad you corrected that. You 
are talking about a mass mailing without it being requested. 

Chairman MURIS. Right, right. 

Chairman Shelby. Okay. 

Chairman MuRis. And I am saying I can understand if Senator 
Corzine wants to look at his credit report a lot; I can understand 
that. I can understand if Senator Bennett or somebody else does 
not. And I think it should be at the — 

Chairman Shelby. Yes. But just a mass mailing — we do not have 
mass mailings by the States now, do we? 

Chairman MURIS. No, no, no. 

Chairman Shelby. Okay. I am glad you corrected that. That was 
bothering me, because after these hearings that we have been hold- 
ing for the record, gosh, I have just ordered a credit report on my- 
self. I do not intend to borrow any money today or buy something, 
but maybe tomorrow — and with identity theft and the horror sto- 
ries, I am going to look at my credit report and see how accurate 
it is. I had not thought about it before these hearings, but 

Senator Bennett. I am afraid to look at mine. 

Chairman Shelby. Oh, I might be afraid, but I think it might 
be smart, especially if you are contemplating buying something, be- 
cause of this. 

Let me see if I am right in this from what I have heard from the 
record over a series of hearings. Let us say, Mr. Chairman, that I 
apply for a loan that is advertised at 5 percent on a house for 30 
years, or whatever it is, SVt, and they run a credit check on me, 
and they come back and say, ‘You do not qualify for that, but I am 
making you a counteroffer. I will make you a counteroffer for 6% 
or 7V4.” And I am desperate for the money — like everyone, time is 
of the essence — so I say okay, I will take it, because the payments 
are dragged out. But I still do not know what is in the credit re- 
port, because they have made a counteroffer to me, as I understand 
it now, that may have deemed my credit score to be lower than or- 
dinary. And the ordinary person — gosh, I would not have known 
anything about the scoring of credit until we had these hearings — 
you know they do not know what that is based on. The average 
American citizen would not know. 

That is why we are going to have our next hearing on financial 
literacy, which I think is important. 

Chairman MuRis. Oh, absolutely, I agree. 

Chairman Shelby. So, I guess what bothers me some is that by 
making a counteroffer to me, they do not have to disclose what is 
in my — or, give me a copy of my — credit report. Now, if they turn 
me down — in other words, they are not turning me down; they are 
just making me a counteroffer — that bothers me. 

Chairman MURIS. I agree, and that is why we think in that — 

Chairman Shelby. How do we work around that somehow? 

Chairman MuRis. We have recommended that you change the 
law so in that situation, they need to get an adverse action notice. 

Chairman Shelby. Okay. You see where I am coming from. 

Chairman MuRis. Oh, absolutely, absolutely. 



379 


Chairman Shelby. We had the horror story of the young man 
that Senator Dodd talked about, the young army captain, and his 
life has been ruined because of identity theft and everything that 
goes with it. 

Chairman MuRis. Look, I completely agree about the horrors of 
identity theft. We spend a lot of time working on identity theft. I 
think this system is ingenious, and because of the adverse action 
notice, because of the risk-based pricing that you are talking about, 
there has developed a large situation which did not exist when the 
statute was passed, and we need to fix that. 

I personally have a less risk-averse attitude about looking at con- 
sumer reports — until I went through the confirmation process, 
when it turned out there was a wrong address in my credit report 
which was not relevant for credit, but it was relevant for my con- 
firmation. That was the first time I had ever looked at it. And I 
think that is a fine rule for me, and if somebody else wants to have 
a different rule of their life and spend more of their precious time 
reading their credit report, I think they should be able to do that. 

Chairman Shelby. I want to ask these questions for the record, 
because we are going to have votes, and we are going to have an- 
other panel, quickly. And you can do it, Mr. Chairman, for the 
record, as soon as you can. 

Chairman MuRis. Yes, sir. 

Chairman Shelby. Do you believe the consumer has the ultimate 
responsibility for ensuring his or her credit report is accurate? 

Would providing consumers access to free credit reports enable 
them to be more proactive in ensuring accuracy? 

Doesn’t greater accuracy ultimately benefit consumers, the credit 
reporting agencies, and credit providers — all of them. 

Do you consider a consumer credit report that contains incom- 
plete information to be accurate? 

What is your understanding as to the efforts credit bureaus 
make to get furnishers to provide full-file reporting? I believe this 
was brought up earlier today — in other words, not to game the sys- 
tem and so forth. 

What incentives are there for furnishers to withhold information 
that we have read about at times? 

Do you think that the average consumer understands that they 
can suffer negative consequences because a firm they have a credit 
relationship with decides to — yes — underreport information regard- 
ing their credit history? Do you think they should be made aware 
of the underreporting activities of these companies? 

These questions we are interested in getting to. 

Chairman MuRis. We would be glad to answer those. 

Chairman Shelby. At the end of the day and at the end of these 
hearings, which we are hoping to get to, we are interested in accu- 
racy — which is very important on both sides of the aisle to every- 
body — because we should do everything to have the credit report 
accurate, because accuracy depends on money, doesn’t it, and the 
cost, among other things. 

So, we are going to be working with you on this, and we appre- 
ciate your appearance here today. 

Chairman MURIS. Thank you very much. 

Chairman Shelby. Thank you. 
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Senator Bennett. 

Senator Bennett. The bells have not gone off for the votes yet, 
and I would just like a quick second round as well. 

I have been denied credit because of a credit report, and the 
credit report was entirely accurate. I have had some rough patches 
in my life where I have missed some payments and all the rest, 
and that is the only time I have seen my credit report. And yes, 
there were some errors in it, and frankly, there was difficulty get- 
ting them cleared up. 

But that was 20 years ago, and I have the feeling now that 
things are a whole lot better than they were because the bureaus 
understand that their livelihoods depend upon their being accurate. 
There was almost an adversarial relationship when I got involved 
in my situation. They did not care whether it was accurate or not; 
they were just selling it. And I think that the culture has changed 
rather dramatically from that time until now. 

I am a little concerned about the score, because I think we have 
a sense that the score is an absolute number. That is, it is an “A,” 
“B,” “C,” “D,” “E,” or “F,” and everybody knows what that means. 
I think the score is a guess from the credit bureau, and then the 
credit grantor puts his own score, based on his analysis, and mar- 
ries it to the score, and pretty soon you have scores on top of 
scores, and it is not an “A,” “B,” “C,” “D,” “E,” or “F;” it is a rea- 
soned judgment on the part of the grantor. And we may be opening 
the door of trying to turn something into an automatic, “Yes, I have 
a right because your score is 73, and 73 is a good enough score that 
I have a right to this credit.” 

And the credit grantor says, “I do not care what the bureau score 

is. I have looked at the report, and I have put a different score on 

it, and I have put a different weighting here, and I am not going 
to give you the credit.” 

“Oh, you have an obligation to give me the credit, and I will be 
back to Congress saying as long as I get a score that is above 65, 
I deserve this, that, and the other.” 

Is that concern well-placed on my part, or am I seeing demons 
here that do not really exist? 

Chairman MuRis. Well, there are several different issues. Sen- 
ator, and I would certainly be concerned with a fixation on the 
number and the score, because different companies use different 
models and different predictions, and if the information were pre- 
sented to consumers in a way that overemphasized the number and 
overemphasized the importance and underemphasized the expla- 
nation of how the system works and, most important, we need to 
provide people with information about how to maintain good credit. 

So, I can see some misuses, probably unintended, in how we 
present that information. I think we have got to be careful in how 
we present it, and we would certainly be glad to work with you. 

But if we are going to provide people information about their 
credit report and how the system works, it seems odd to me that 
we would withhold the score. There is no one score, of course, but 
I think it is important, very important, crucially important, that we 
not overemphasize the significance of the number, and that we put 
the thing in context. 
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Senator Bennett. Okay. We are on the same page here, because 
we all want the consumer to he able to get accurate information 
and complete transparency. My concern is that if we focus on the 
score, we run the risk of distorting the information so that the con- 
sumer then starts to argue, as I said, that he has rights. And this 
is a guess — the score is an estimate — and if we surround the score 
with the kinds of caveats that you have talked about, I get a little 
less concerned about revealing it to 

Chairman MuRis. We certainly do not want to encourage people 
to spend a lot of their time correcting “S’s” and “F’s” — unless it has 
some particular consequence, which it may — given the last name 
“Bennett,” there could be confusion between two people. 

Senator Bennett. Thank you. 

Chairman Shelby. Senator Sarbanes. 

Senator Sarbanes. Chairman Muris, there has been enough tes- 
timony. There are real problems that exist, and the FTC has got 
to step up to this challenge, and we are looking for you all to do 
that. I think it is imperative that that be the case. I just want to 
leave you with that observation, that is all — I am not seeking an 
answer — well, the answer I am seeking would be in your actions. 

Chairman Shelby. Absolutely. 

Mr. Chairman, we thank you for coming. 

I am now going to introduce the second panel before we start our 
votes. We apologize for the length of the hearing, but I think it is 
very, very important. 

Chairman Shelby. Our second panel will consist of Mr. Stephen 
Brobeck, Executive Director, Consumer Federation of America; Mr. 
Stuart Pratt, President and Chief Operating Officer, Consumer 
Data Industry Association; Mr. Richard LeFebvre, President and 
Chief Executive Officer, AAA American Credit Bureau; Mr. David 
Jokinen, a consumer witness; and Mr. Evan Hendricks, Editor of 
Privacy Times, which Senator Sarbanes alluded to earlier. 

We appreciate all of you appearing today. Your written testimony 
will be made part of the hearing record in its entirety, and if you 
could sum up your best points quickly, we would appreciate it. 

Mr. Brobeck, we will start with you. 

STATEMENT OF STEPHEN BROBECK 
EXECUTIVE DIRECTOR, CONSUMER FEDERATION OF AMERICA 

Mr. Brobeck. Thank you. Chairman Shelby, Senator Sarbanes, 
and Members of the Committee. 

My name is Stephen Brobeck, and I am Executive Director of the 
Consumer Federation of America. We very much appreciate the op- 
portunity to give testimony about the need for the Fair Credit Re- 
porting Act to ensure accurate credit report information. 

Let me begin by saying that considering the challenges it faces, 
our credit reporting system functions relatively well. These chal- 
lenges include keeping track of billions of important changes in the 
credit histories of nearly 200 million Americans, and doing so when 
the furnishing of information by lenders is voluntary. 

Yet these challenges have to be met because of the growing influ- 
ence of this information and the related credit scores. Increasingly, 
these credit scores determine whether a consumer can purchase a 
mortgage loan, a consumer loan, auto insurance, homeowners 
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insurance, a rental unit and utilities, and at what price; and in- 
creasingly, these scores influence whether Americans can obtain 
and retain a job. 

As well as being secure, credit report information and scores 
must be accurate. This is especially important for those millions of 
consumers near availability and pricing points. For those individ- 
uals, relatively small errors can mean the difference, for example, 
between credit offers and denials and between prime and subprime 
loans. 

Our research, for example, estimated that millions of Americans 
who should qualify for conventional mortgages are, because of inac- 
curacies, offered subprime mortgages instead. 

Here, it is important to stress that errors of omission can be just 
as damaging to consumers as are errors of commission. If credit 
files, for example, do not include a credit account in good standing 
or even just the related credit limit, the loss of points could be just 
as great as if the file included an erroneous 30-day delinquency. 

So what evidence do we have of the accuracy of the information 
in credit files? There are really two methods of usefully assessing 
accuracy. The first is observing consumer complaint behavior or 
surveying their experience. While useful in assessing consumer sat- 
isfaction, this method is not always reliable in assessing accuracy 
because of consumer lack of knowledge or inertia. The absence of 
consumer complaints, or even perception of credit report accuracy, 
could reflect numerous factors including lack of understanding of 
how to access or understand credit report information such as cred- 
it limits, or how to correct any inaccuracies. 

The second method is independent evaluation of the credit report 
information. An assessment by Government agencies or nonprofit 
organizations represents the most objective, unbiased type of eval- 
uation. While these groups usually lack access to the credit files, 
during the past year, both the Federal Reserve Board and the Con- 
sumer Federation of America, in cooperation with an industry 
group, the National Credit Reporting Association, were able to as- 
sess the accuracy of information in many credit files. 

The Fed studied nearly 250,000 credit files from a single national 
repository, while CFA compared the scores from all three major re- 
positories, reviewed more than 1,700 files in three regions of the 
country, and examined in great detail consistencies and inconsist- 
encies in 51 representative files containing information from the 
three repositories. 

The findings of the two studies are generally consistent. Most im- 
portant, both concluded that there was important information miss- 
ing from many files that unfairly lowered credit scores. The Fed 
found, for example, that more than two-thirds of the files it studied 
contained at least one revolving account that did not include infor- 
mation about the credit limit. This error of omission prevents a de- 
termination of the level of credit utilization which would lower a 
consumer’s credit score. 

After the industry provided a newer dataset, the Fed still found 
that the files of about one-third of people with a revolving account 
failed to include information about the credit limit. 

In addition, the Fed cited evidence that some creditors report 
only derogatory information. The CFA study also discovered the ah- 



383 


sence of much positive information from many files. The principal 
reason for the frequently wide variance in credit scores among the 
three repositories, which for 4 percent of consumers studied was 
greater than 100 points, was significant differences in the informa- 
tion contained in the three files. 

Errors of omission tending to lower credit scores included the 
failure to report credit limits on revolving accounts, revolving ac- 
counts in good standing, and mortgage accounts with no late pay- 
ments. 

Less frequent errors of commission that we did detect, however, 
included the inclusion of an account not belonging to the consumer, 
a false collection, or a false indication of bankruptcy. 

One way that lenders minimize the risk of using inaccurate in- 
formation in credit files is to use only the middle credit score pro- 
vided by the three repositories. But in general, only first mortgage 
lenders consider all three credit scores. Usually second mortgage 
lenders, consumer lenders, insurers, and others use the scores of 
only one repository. 

If these scores tracked median scores, potential biases would be 
minimized — ^but they do not. The scores of one repository are far 
more variable than are the median scores of the three major reposi- 
tories, and in addition, even the median scores reflect errors of 
omission and commission that could result in the unfair denial or 
overpricing of credit or some other important services. 

I have exhausted my time so I will save my recommendations for 
responses to your questions. 

Thank you. 

Chairman Shelby. Thank you so much. 

Mr. Pratt. 


STATEMENT OF STUART K. PRATT 
PRESIDENT AND CHIEF OPERATING OFFICER 
CONSUMER DATA INDUSTRY ASSOCIATION 

Mr. Pratt. Chairman Shelby, Senator Sarbanes, and Members of 
the Committee, thank you for this opportunity to appear before you 
again. I guess I am trying to compete with Mr. Beales in terms of 
how many times I get to come back. 

Chairman Shelby. We will probably get you back again if you 
will come. 

Mr. Pratt. Thank you, sir. 

We are the Consumer Data Industry Association, and for the 
record, I am Stuart Pratt, President and CEO of that organization, 
and we do commend you for holding this hearing on accuracy. Ac- 
curacy is the lifeblood of how the credit reporting system works, 
and I thought, Mr. Chairman, that what you said in the beginning 
was right on — the law says that maintaining an accurate credit re- 
porting system benefits everyone, and in fact, I think Senator 
Johnson said the same thing in his opening remarks. 

Accuracy is dealt with in the law in a couple of ways. We have 
heard about that. Consumer reporting agencies have to have rea- 
sonable procedure to assure maximum possible accuracy. In 1996, 
data furnishers were included under the law for the first time, and 
they were also given an accuracy standard by which they must live. 
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The marketplace drives accuracy for us, and it is one means by 
which we can try to measure the general success of consumer re- 
porting. We have a better credit market than ever before, and we 
have safety and soundness well in hand, I think, and those are cer- 
tainly good metrics, I think, by which to measure the general per- 
formance of the consumer reporting system in this country. 

The marketplace also drives the consumer reporting agencies to 
compete on accuracy. This is what lenders do. They look at us care- 
fully, and they expect us to produce accurate reports, and they ex- 
pect us to produce reports that will allow them in turn to allow the 
consumer to drive off the car lot with a car with nothing more 
than, really, a promise and the consumer report. 

There is no doubt that “accuracy” is a tough term to define. I 
think we circled around that a little bit in some of the previous tes- 
timony. For example, inaccuracy is, as Mr. Brobeck testified, miss- 
ing information, or at least that is a term that has been applied 
to it. 

I think it is a good time to remind all of us that in fact the con- 
sumer reporting system is voluntary. We cannot compel any lender 
in the country to report information. So, of course, while we do 
have data acquisition people out there every day of the week trying 
to convince every lender in the country or every furnisher to report 
to that particular consumer reporting system, there is no doubt 
that there will be some missing information because a small lender 
may just choose not to report to any or may just choose to report 
to the one with which they are most familiar, and that can happen 
in the marketplace. 

There is also no doubt that some consumers, because of how cali- 
brated the decisions become with scoring, desire their file to be al- 
most instantaneously updated so that if they wrote a check in a 
given month and paid down a balance, they would love for that bal- 
ance to be immediately reported to the bureau. Most lenders report 
on a 30-day cycle. It is voluntary. The three bureaus cannot force 
a lender to report on a more frequent cycle. So the file is accurate 
as of the date reported, but may not be accurate in the eyes of the 
consumer, who says, “Well, my gosh, I paid something down.” 

There are times when consumers misunderstand divorce decrees, 
there are times when consumers misunderstand how a court may 
make a decision about whether or not a contractual credit obliga- 
tion is severable or not, and we do run into those sorts of percep- 
tion issues with consumers and actually spent quite a bit of time 
with consumers on the phone when we look at their files, and they 
are looking at their files, talking to them about that. And there are 
times when consumers at the end of the day will say, “You know, 
I guess that is right. That is how the law works. I may not be 
happy about how that law worked, but you are right in terms of 
my file; the information is accurate.” 

We have tried to put some contexts that are more metrics-driven 
than all of this. For example, let us just set up a larger context. 
Two billion files are sold every year in this country, and interest- 
ingly enough, about 2 billion updates are reported to the credit re- 
porting systems. There are 200 million consumer files in each of 
the nationwide consumer credit reporting agencies, and there are 
30,000 data furnishers providing data into this system. 
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Every year, about 16 million consumers obtain their file disclo- 
sure from the consumer reporting systems. That is the aggregate 
number for all three. That is their right under the law, and about 
95 percent of those are free-of-charge. That is about eight-tenths of 
1 percent of all files sold in the marketplace when you take that 
16 million and put it into the context of how many files were sold. 

We do try to look at how consumers review their files. Sixteen 
million look at it every year. A little more than half those con- 
sumers never call us back. Our full statement for the record in- 
cludes the fact that when you look at smaller populations, some- 
times the contact rate — not the dispute rate, but the contact rate — 
is about 5 or 10 percent, which means that about 90 or 95 percent 
of the consumers who looked at these sets of files, as far as we can 
tell, thought that they were working well. 

We did look at the marketplace, in closing, and we asked some 
of our resellers, who are also members of the CDIA, to take a look 
at the mortgage marketplace. So, we had a review of about 189 
merged reports — that is over 500 consumer in-files from the three 
national systems — and out of that, we asked them to identify when 
were they updated information to make sure it was as current as 
possible, and when was the data just absolutely wrong, and it was 
wrong as of the date reported. About 1 percent of the time, the 
data was wrong, at least in this study, and about 32 percent of the 
time, they were updating something in the record. 

I see my time has expired, and I appreciate the opportunity to 
be here and would be happy to answer any questions. 

Chairman Shelby. Thank you, Mr. Pratt. 

Mr. LeFebvre. 

STATEMENT OF RICHARD F. LeFEBVRE 
PRESIDENT AND CHIEF EXECUTIVE OFFICER 
AAA AMERICAN CREDIT BUREAU, INC. 

Mr. LeFebvre. Good afternoon. Chairman Shelby, Ranking 
Member Sarbanes, and distinguished Members of the Committee. 

My name is Richard LeFebvre, and I am President of AAA Amer- 
ican Credit Bureau, a CRA reseller of consumer reports. I thank 
you for the opportunity to testify before you today on an issue that 
is fundamentally important to the American economy, as well as to 
individual Americans. 

The FCRA is a consumer statute — not an industry statute, as 
some would like you to believe. We are here to discuss accuracy, 
but first we have to define what an error is. An error is any mis- 
leading, incomplete, and/or outdated data which fails to convey the 
full and true picture of the consumer’s credit reputation, credit 
risk, and creditworthiness. 

Accuracy comes in three facets — first, accuracy at the national 
repository level; second, at the CRA reseller level; and third, at the 
user level. This is explained in my prepared statement. 

Let me define rescoring. Rescoring is not credit repair. In a nut- 
shell, rescoring is the updating of credit information that is in 
error, for a very large fee. This is not meant to say that all reports 
have inaccuracies and significantly reduce credit scores and in- 
crease credit risk. 
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On repository error rates, the CFA/NCRA study, and a study 
that AAA conducted in 1999 through 2000 confirmed what we all 
knew. Please remember that these two studies only cover com- 
paring data under 1681(e)(b) and not under 168 l(i) reinvestigation. 
So the numbers would more likely be higher if a true reinvestiga- 
tion were done. 

Industry will attack the study, but just remember that the two 
studies were conducted on consumers who were involved in a mort- 
gage process, which many times is the better credit risk consumer. 

It astonishes me to this day how the same credit furnisher can 
report different information about the same account to all three re- 
positories, but it is the common problem. Perhaps it is a “Tower of 
Babel” problem. CRA resellers stop performing. CRA resellers are 
supposed to follow reasonable procedures to assure maximum pos- 
sible accuracy. This means that if any reseller sees differences in 
the reporting, they must verify the accuracy with the furnisher of 
the information to assure maximum possible accuracy. The reseller 
is now on notice that he cannot rely on the data coming from the 
repositories. The bar is raised to even a higher standard the 
minute the consumer disputes for a reinvestigation. The users of 
both GSE’s must stop preventing CRA resellers from doing their 
duty under the FCRA. If not, consumers do not get the benefit of 
the bargain or the protection of the FCRA. If the FCRA requires 
CRA resellers to perform, but Fannie Mae and Freddie Mac will 
not accept that performance through their AU systems, then the 
FCRA is being undermined every day. 

Consumers cannot fight what they cannot see, and by not allow- 
ing transparency for consumers during the mortgage process by 
disclosing copies of their consumer reports, credit reports, and/or 
adverse action notices, we truly do not have transparency, at least 
on behalf of all consumers. 

Efficiencies in processing applications and increasing sophistica- 
tion in credit underwriting rules should not be mistaken for assur- 
ing maximum possible accuracy. Indeed, automated systems must 
not be allowed to interfere with these requirements of the FCRA 
and/or the opportunity of consumers to dispute. 

For example, Mr. Smith applies to buy a home, puts into escrow 
his entire life savings as a nonrefundable deposit, as required in 
most real estate transactions. He knew when he checked his credit 
report 6 months ago that it was great; but now he finds out he is 
a victim of identity theft, fraud, or inaccuracies. This is where 
many times, consumers find out for the first time they are victims. 

He calls ABC reseller, who is prohibited from helping him under 
H.R. 2622, or currently in any AU system. This changes the FCRA 
and the FTC’s consent order with Credco. So the consumer is faced 
with two options — first, walk away from the property he selected 
and lose his deposit because the real estate contracts do not allow 
refunds unless you have been turned down; or, second, he would 
take the subprime A-minus loan, which changes the rate consider- 
ably, the terms may require more down payment and may even in- 
clude a prepayment penalty. 

This is a decision that consumers should not have to face when 
buying a home, which is many times the largest consumer pur- 
chase, their life savings and their future financial nest egg. 



387 


Does the consumer deserve adverse action in this example? Yes. 

In closing, inaccuracy leads to higher rates and terms. It also 
leads to increased credit risk for new lenders, lowering consumers’ 
creditworthiness, credit reputation, and harming the consumer and 
the lender who lost the chance to do a good loan. 

Lenders, the GSE’s, and the repositories are taking away con- 
sumer choice because they are forcing consumers to check their 
credit files in advance, or buyer beware and/or be ready to pay ex- 
tremely high fees for rescoring or higher fees and costs for a mort- 
gage. It is a position that consumers should not have to face. All 
consumer reporting agencies are to assure maximum possible accu- 
racy, or are we just giving lip service to the banking industry and 
to the consumer whom we are trying to protect? 

I thank you, Mr. Chairman, for the opportunity to testify and 
present my views, and I would be happy to answer any questions 
you may have. 

Thank you. 

Chairman Shelby. Thank you. 

We have about 50 seconds left on a vote, and there may be two 
votes. So, we are going to come back — I know I will — and we will 
try to let you two testify and then probably have some questions 
for the record. 

We will stand in recess until we can get back in a few minutes. 

[Recess.] 

Chairman Shelby. The Committee will come back to order. 

We will continue with our panelists. Mr. Jokinen, we welcome 
you here today. Your written testimony, as I said earlier, will be 
made part of the record. You can tell we are dragging the hearing 
on all day, but please sum up your pertinent points. 

STATEMENT OF DAVID A. JOKINEN 
SUGAR LAND, TEXAS 

Mr. Jokinen. Thank you very, very much. I appreciate it. 

It is not my desire to be here today, but I do have a story about 
being declared a “dead man walking” for over 2 years that I think 
is important. 

Chairman Shelby. You look alive today, though. 

Mr. Jokinen. Yes. On certain days, I have to check my pulse. 

Chairman Shelby. I want to hear your story. 

Mr. Jokinen. I have a little background information in my testi- 
mony that simply says that I have a dual master’s from MIT and 
Harvard, and I have been a professor in Europe, so I am not unso- 
phisticated in trying to resolve this, but it has taken me over 2 V 2 
years, and I still do not have it resolved. 

Chairman Shelby. Tell us what happened. 

Mr. Jokinen. Yes. My mother died on April 30, 2001. She was 
95 years old. She had three credit cards with three different banks 
which I was a cosigner on, because at the end, her hand was too 
shaky to sign, and I was cosigner for her Social Security checks. 

I contacted all three banks immediately, sent death certificates, 
and said, “Please, I will honor any bills that she has, but please 
clear this up. And since I was a cosigner, if it is agreeable with 
you, I would like to be able to use these as cards of my own after 
your time period — whatever you need.” 



388 


All three said fine. The Bank One card got cleared up in 2 weeks; 
People’s Bank, a little company in Connecticut, got cleared up in 
2 weeks; and Chase Bank has been an ongoing sore. 

Right now, I have two cards with me from the Chase account 
that is disputed, and I have two more cards at home that they keep 
sending me, with my name on them, and they have extended my 
credit on that account 10 grand — but I am still declared dead. So 
it is a case of the left hand at Chase Bank not even knowing what 
the right hand is doing. 

Chairman Shelby. Have you gone to the doctor lately to see if 
you are really alive? 

Mr. JoKiNEN. Yes. Every now and then, I have a checkup — about 
as often as I read the credit bureau reports. 

But really, when it starts to hurt is when you go for refi- 
nancing — and you have talked about home mortgaging — and that is 
when I really discovered the problem. 

Chairman Shelby. Absolutely. That was our point earlier today. 

Mr. JoKiNEN. Yes, exactly. You have to get three bureau scores; 
but only one score showed up when I went for refinancing 2 years 
ago, much to my surprise. I said, “Oh, what is going on here?” I 
had no idea that this was possible. I grew up in the Midwest, and 
I honestly assumed that Federally regulated systems work. I read 
all the nice platitudes about the Fair Credit Reporting Act, and I 
said something is crazy here — this does not make any sense. 

So, I got a copy of the FTC rules, and I filled everything out and 
sent it in. I have done that 12 times in 2 years. 

Chairman Shelby. Twelve times? 

Mr. JoKiNEN. Twelve times, to the credit provider, plus to the 
three bureaus. There used to be a Book-of-the-Month Club — now 
we have David’s Death-of-the-Month Club. I have no idea from 
month to month whether I will have one bureau, two bureaus, or 
three bureaus saying I am dead. Sometimes none of them delcare 
I am dead that month. 

Chairman Shelby. And how many years has this been going on? 

Mr. JoKiNEN. Over 2 years. We used to have a 30-day rule that 
I heard about someplace. I am on the 714th day with this problem. 
I do not know where the 30-day rule applies. 

I have communicated with Chase Bank, in writing or fax, 12 
times. It is such an obvious error that I have been able to get the 
staff at Chase and at the three bureaus — which I now call “the 
Three Stooges” — to talk to me candidly because they know the 
story. They know it is so ridiculous on its face, that they start to 
tell me what is really going on in their own corporate back yards. 

So, all of a sudden, I am no longer naive. I have become very 
wise — or battle-scarred, I should say — as to what really goes on. 

A mortgage banker friend of mine 2 months ago said, “David, be- 
fore the rates go up, you have got to get your house refinanced.” 
So he found a sophisticated lender to whom I explained the whole 
story of the Death-of-the-Month Club. He said, “Well, we have to 
get a letter from the Federal Government saying you are alive.” 

I said, “How do you do that?” He said, “That’s our problem. We’ll 
figure it out, and you just do it.” 

Chairman Shelby. How would they know you are alive? 
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Mr. JOKINEN. Well, I will tell you the story — I have the letter 
right here — I did not include it in my report. 

Chairman Shelby. Go ahead, sir. 

Mr. JoKiNEN. What happened was that particular month, I had 
two credit bureau scores that we could not get. The idea was that 
since the secondary market is now controlled by Freddie Mac and 
Fannie Mae with guidelines, if they got somebody from the Govern- 
ment to say that I was alive their underwriters would approve my 
loan. This is like the old story about Santa Clause having the post 
office endorse him for being alive, that old “Miracle on 34th St.” 
movie classic from years ago. 

They said why don’t you go to the Social Security office — ^because 
I am older than 65. They know me down there. I walked into the 
Social Security office and said I would like a letter saying I am 
alive. They looked at me totally nonplussed. It kept going higher 
up their management ladder until finally, the office manager in the 
Houston office came and said, “It is not in our Federal handbook 
how to do this. Do you mind if I call Washington?” I said, “No. I 
can stay here all day.” 

That man from Washington wanted to talk to me to make sure 
that I was a live person talking. Afterward, they started laughing, 
because it just became obviously ridiculous. 

So, I now have this letter from Social Security — which they said 
they had never written before — saying that I am alive. I did not 
put it as part of the evidence, but I think it is a classic document. 

Chairman Shelby. It is good. 

Mr. JoKiNEN. I got my mortgage. 

Chairman Shelby. Can you furnish a copy of that letter for the 
record? 

Mr. JoKiNEN. Oh, yes, sir, absolutely, absolutely. 

So, I finally got my mortgage. When I look at my out-of-pocket 
costs, hard dollars, it is about 250,000 hard dollars that this credit 
mistake has cost me in the last 2 V 2 years. 

Chairman Shelby. Two hundred fifty thousand dollars. 

Mr. JoKiNEN. Yes, sir, yes, sir. 

Chairman Shelby. Oh, gosh. 

Mr. JoKiNEN. Yes. And I have documented that in my written re- 
port as far as where it went. 

And then, the emotional truama — my mother was the longest liv- 
ing tuberculosis victim from World War II who lived on half a lung. 
She was in a TB sanitarium for a couple years when I was a little 
kid in elementary school. I did not see her for 3 years. She had one 
lung removed; this was called the “pneumonectomy,” and it was a 
standard medical procedure back then. They do not do it anymore; 
it is rather barbaric for a medical procedure. 

But when she was being released, the doctor said, “Mrs. Jokinen, 
you have about 2 to 5 years of life-expectancy, because you will 
now be overworking the other remaining half of your lung with 
your whole body’s use. It wears out very quickly. That is what the 
survival averages are, and we just want you to be aware of that.” 

She looked at the doctor and said, “Sir, I will decide this matter 
with my maker, and just because you have ‘M.D.’ after your name 
does not mean that you are going to tell me when I am going to 
leave this earth.” 
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When I contacted the TB Association and the American Lung As- 
sociation, they had never heard of anybody living that long with 
half of a lung. They are now checking the world records. They have 
told me that she probably outlived anybody. 

But at the end, she had a couple of years where she was really 
in pain, coughing up blood, living in a wonderful nursing home. I 
relived her agony every time I get a notice that I am dead this 
month. I go through this sad memory, and it is really excru- 
ciating — I can feel my bones shiver. 

Chairman Shelby. There has to be a better way, doesn’t there? 

Mr. JOKINEN. Oh, I think so. And I am at your mercy to do so. 
I made a suggestion as to how to solve the problem. 

Chairman Shelby. Go ahead, sir. 

Mr. JoKiNEN. To me it is a very simple problem to solve. When 
I started getting the real story from the back office of “the Three 
Stooges” and Chase Bank, their own people told me what would 
stop this ridiculous stuff. It is a faceless, nameless person to whom 
you “The Consumer” talk to. You never have that person’s name 
the next time you call in, the consumer contact staff at Chase Bank 
and the 3 credit bureaus said, “We have to be made accountable, 
but nobody in management wants to do it.” 

So, I thought about this process when I was asked to come here. 
I have been a stockbroker licensed by the NASD and the SEC. That 
is what this FCRA needs. What I suggest is that the FTC or some- 
body stronger than them have the same power that the SEC has. 
Take this credit industry and make a self-regulatory agency within 
the industry; and paid for by the industry. Every human being who 
has contact with the consumer must be trained. They are not li- 
censed or trained professionally at the moment. I asked them what 
their backgrounds were. Once they are licensed, they must also 
take continuing education programs. If they are licensed, they can 
lose their license to work in that industry. Not only will they be 
individually licensed, but also the three bureaus and all the infor- 
mation furnishing people and companies will be licensed. This is a 
much more precise and easy way to enforce accuracy. What we 
have now is industry promoted fairy tales. I feel the “Fair” Act is 
a “fairy tale” Act. It has wonderful words, it sounds great; but 95 
percent of the players do not follow it. There are no teeth in the 
existing Act. I am just trying to create a sense of consumer ac- 
countability. It is a real simple and inexpensive solution. 

Thank you so much for your time. 

Chairman Shelby. We appreciate your experience, and I believe 
you are alive, too, sir. 

Mr. JoKiNEN. Yes, last time I looked. 

Chairman Shelby. Mr. Hendricks, thank you for your patience. 
We also thank you for what you have done over the years. 

STATEMENT OF EVAN HENDRICKS 
EDITOR AND PUBLISHER, PRIVACY TIMES 

Mr. Hendricks. Thank you. 

I want to start by thanking my Senator from Maryland, Ranking 
Member Sarbanes. 
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Chairman Shelby. Absolutely. Senator Sarbanes has another 
meeting, and I do not know if he can get back, but he wanted to 
express his regrets. 

Mr. Hendricks. It was a kind introduction, and over the years, 
he has made us proud by consistently doing so well for our State. 

And I have to thank you, Mr. Chairman, because you are giving 
hope to the American public that we might actually make some im- 
provements in the system that has such a deep and profound im- 
pact on their lives, so thank you for your leadership. 

Chairman Shelby. I will tell you, Mr. Hendricks, you can tell 
from the record we are building, and both sides of the aisle. Repub- 
licans and Democrats on this Committee, that we are going to 
make some changes. We are going to make some good changes, and 
I think it will be good for industry, and it is going to be good for 
the American people, because it is too important to ignore. 

I think Mr. Pratt, Mr. Brobeck, all of you, would think that. Now 
the question is to do it, and as Senator Corzine, Senator Crapo, 
Senator Allard, Senator Enzi — we all want to do it right, and this 
is the time to do it, is it not? 

Mr. Hendricks. Oh, we could not agree more, and you being in 
this position reaffirms my faith in God. Thank you. 

Chairman Shelby. Oh, do not go that far. 

[Laughter.] 

Mr. Hendricks. Well, we have miracle of credit, and we have the 
FTC Chairman granting other miracles, and thanks to Mr. 
Jokinen, because he can show us that just because thousands of 
lives are being ruined, we can still have a few good laughs, too; 
right? 

Chairman Shelby. He has the humor; he has not lost that, so 
you know he is alive. 

Mr. Hendricks. Yes. Let us walk through the accuracy problem. 
In a practical sense, accuracy is not necessarily the priority of the 
credit reporting system. 

The credit bureau’s job is to make sure they do not miss any- 
thing in your credit history, because if they disclose a credit report, 
and they miss something bad, the credit granter will blame them. 
So, they have to maximize the amount of information they possibly 
disclose about a consumer, and to do that, they use what is known 
as partial matches — partial matches of names, partial matches of 
Social Security numbers. This can work, and it can also be a major 
cause of inaccuracy. 

At the end of my testimony, I printed out some examples of how 
Judy Thomas of Klamath Falls, Oregon was mixed with Judith 
Upton of Stevens, Washington, because their Social Security num- 
bers were one digit different, and the algorithm just assumed it 
was a mistake and they were the same person. 

Myra Coleman of Itta Bena, Mississippi was mixed with Maria 
Gaytan of Madera, California. The person had used Ms. Coleman’s 
Social Security number, so it was an exact match on that, and that 
wiped out all the differences in their names and locations and al- 
lowed Ms. Gaytan to basically have a joyride in an identity theft 
situation. 
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It is maddening when they mix files; it is more maddening when 
they cannot seem to unmix them, and that gets us into the reinves- 
tigation and the problems with 

Chairman Shelby. Excuse me. Why can’t they unmix them — and 
we have heard stories here last week, 2 weeks ago. Go ahead. 

Mr. Hendricks. There are several reasons. One, I think the vol- 
ume of these partial matches creates such great volume — and if 
Senator Bennett were here, he would hear me say that there are 
approximately 7,000 to 10,000 disputes a day at a credit bureau. 
Capital One has seen its disputes go from 1,000 a day 18 months 
ago to 4,000 a day currently. That creates volume. So they have to 
create an automated system to deal with this, and the automated 
system boils down to the person you described at the credit bureau, 
reducing the dispute to a two-number or two-letter code that they 
transmit — let us say Judy Thomas writes in and says “This is not 
mine; I never had a credit card with you” — and the credit bureau 
then, instead of relaying all the relevant information, just trans- 
mits a two digit code to say, “Consumer says not mine.” 

The credit granter then responds with a code to the credit bureau 
saying, yes, we reported that Judith Upton was responsible for this 
account, and then the credit bureau says it is “verified as re- 
ported.” That is how they define a “reinvestigation,” and that is 
how they define “verified.” 

So, it is extremely problematic, and that is why this loop con- 
tinues. And also, in terms of why does information get reinserted, 
when the subscribers or their furnishers submit their tapes every 
month, again, the credit bureaus use many of the same algorithms, 
and those algorithms will throw the information back into the file, 
unbeknownst to the consumer. 

The thing about the system is that the credit bureaus to my 
knowledge have an official policy that if you sue or you threaten 
to sue, you get priority status. So, we have created a system where 
pretty much if you want to get your credit report corrected, and 
you have a situation like this — and many other consumers have — 
you have to litigate. That is why we think we need to have min- 
imum statutory damages per violation, the right to go to small 
claims court and stay there, and a catalyst theory for attorney’s 
fees. And also, the FTC has now endorsed the reinvestigation du- 
ties extended to the credit granters. 

The thing about damages is that every time they get into court 
and hear the story about Mr. Jokinen or people like him, the credit 
bureaus say, “That is too bad, but you were not really damaged.” 
So there are a lot of things we can do to specify what every Com- 
mittee Member here has said, that this is extremely damaging to 
people. 

Another good study that Mr. Brobeck cited is the Federal Re- 
serve Board study which said that they could not rely on credit bu- 
reau data to predict the economy. But the Federal Reserve Board 
said, “What do we do about this?” Well, we can improve access to 
people’s own credit reports and consumers have to be more vigilant 
about access. 

That is why the free access one per year is a good idea, but I 
think we can take it to the next level. I think we have to have the 
goal of plugging people into their own consumer reports the way 
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that all the credit granters are plugged into all consumer reports. 
And the good news is that the credit reporting agencies have cre- 
ated the infrastructure for this with their monitoring and alert 
services. 

The bad news is they charge excessively for it — $80 to $120 a 
year to sell back to you your own data — ^but the advantage of this 
kind of system is fantastic, because it reduces the cost of getting 
notice and a bunch of other things which I will not go into. 

But I think also here is a win-win in Mr. Pratt — may I call you 
Stuart 

Mr. Pratt. Stuart is good. 

Mr. Hendricks. — okay — this is where we can actually get a win- 
win, because if they have a million people paying $80 a year, that 
is $80 million; but if we get 30 million people at $10 a year, that 
is $300 million. And then they can hire enough dispute handlers 
so they can have a better dispute process. 

So, I think there is clearly a win-win here, and I think the Act 
can do this by capping the price of these services just as it does 
the price of a credit report. 

In conclusion, I would like to say a note about the prescreening 
issue. I think Senator Sarbanes cited our study from Privacy Times 
from a few weeks ago, that now we know criminal gangs are sys- 
tematically targeting mailboxes and stealing mail for preapproved 
credit offers, convenience checks, whatever personal information 
they can get. If they cannot turn the instrument into cash itself, 
they sell the information to a fence. 

I talked to five postal inspectors. It is very authoritative stuff 
and very scary. 

I think now that the FTC has demonstrated that the Do Not Call 
Registry is something that is very important to Americans with 
junk phone calls, I think the next thing we have to look at, and 
that we recommend, is that we need to have a “Do Not Mail Me 
Financial Data and Offers Registry” for people who know they do 
not want the risk of having their mailbox hit. 

So just strengthening the preapproved, prescreening process is 
important, but I think we need to take it to the next level to handle 
the problem. 

Thank you. 

Chairman Shelby. I thank all of you for your testimony. 

I am going to ask some questions now — and you can tell we are 
really pressed for time — and then we are going to have a number 
of questions for the record that I hope we can submit to you. 

Mr. Pratt — as fast as I can go — you provided a lot of information 
to the General Accounting Office that touches on inaccuracy in con- 
sumer disputes. From this submission, I have not been able to 
make out any definitive information with respect to the total — yes, 
total — number of disputes consumers lodged with the three big 
credit repositories. 

Is the number the same as the 16 million file disclosures that are 
made each year, or is it something more, something less? Could you 
tell us quickly the total number of disputes that are made to the 
credit bureaus — and when I say “the total number of disputes,” for 
the record, we want you to include disputes made over the phone. 
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through the Internet, through the mail, and by way of other means 
by which consumer dispute communications can be made. 

Can you answer that now, or do you want to answer that for the 
record? 

Mr. Pratt. I think because of the particular detail of the ques- 
tion — there are many parts to it — I would like to answer in writing 
for you. Senator Shelby. 

Chairman Shelby. That would be good. 

Mr. Pratt. But Mr. Chairman, just very quickly, out of the 16 
million consumers who look at their files, we estimate that prob- 
ably a little less than half of those consumers pick up the phone 
and call us back. You have seen some populations in our testimony 
where we said people who looked at their files — many of those con- 
sumers are adverse action consumers; 84 or 85 percent of the files 
we issue for adverse action, which is one of the reasons why you 
can get a free file. So the rate of calls seems to be higher, because 
I think a lot of people call so they can ask, “Why was I declined?” 

So, we do educate consumers, and I am drilling down to try to 
get you a better number on that, and we will be happy to do that. 
I recognize that in our testimony, we are not absolutely black and 
white. We did try to drill down and say that we get about half 
again as many calls, and then — it depends — 25 to 30 percent are 
disputes, and then the nature of those disputes, and as we have 
said before in our testimony, disputes do not always equal inac- 
curacies. Disputes are sometimes actually about information that is 
accurate as to the time reported — but I would like to get that up- 
dated a little bit. 

Chairman Shelby. But it seems to me that whether you rep- 
resent industry or consumers, or just a citizen consumer like most 
of us, that the key to all of this is the accuracy — what goes in and 
what comes out has to be as accurate as we can possibly make it 
to improve the system. That is in the interest of the industry as 
well as, but ultimately, it affects the consumer greatly. 

Mr. Pratt. There are instances where — and obviously, I have 
had a couple of conversations with Mr. Jokinen and similarly with 
Captain Harrison when he was here as well — those are learning 
moments where you learn something about the system. There are 
some contexts that I could share with you about some of that along 
the way, but there is no doubt the goal is learn from that, Mr. 
Chairman — not to simply say, well, gosh, that is one instance, and 
let us just move past that one. 

Chairman Shelby. That is why we are holding these hearings for 
the record, because we have never done it before. 

Mr. Pratt. Yes, sir. 

Chairman Shelby. Would everyone agree that an error as sig- 
nificant as yours, as to whether or not a person is alive or dead, 
should be quickly recognized and permanently resolved — ^yes or no? 

Mr. Pratt. Yes. 

Chairman Shelby. Everybody says yes. 

Mr. Jokinen. Yes. 

Mr. LeFebvre. Yes. 

Mr. Pratt. May I just add — if we can verify it. We were last year 
in hearings — 
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Chairman Shelby. There has to be a way to do it and do it 
quickly, though, doesn’t there? 

Mr. Pratt. If we can do it quickly. Let me just add that one of 
the keys — and I am not at all denigrating in any way or trying to 
in any way reframe Mr. Jokinen’s testimony. 

Chairman Shelby. It has to be difficult. He is well-educated. 

Mr. Pratt. My gosh, yes, a lot more than I am. Last year and 
in the year prior, with September 11, we were asked why could a 
Social Security number still be used when it was part of the death 
master file of the Social Security Administration. So then we had 
hearings on the death master file, and we heard about how the 
NTIS could escalate the data to us, and then we learned that State 
agencies do not report data quickly enough to the Social Security 
Administration. 

One of the challenges for us is to be able to pull away the wheat 
from the chaff and make sure that we absolutely get it right the 
first time with Mr. Jokinen and then also absolutely get it right 
when the Social Security number should not be in circulation. 
Those are the two challenges. 

Chairman Shelby. Mr. Hendricks and Mr. Jokinen, quickly, 
what do you think — and I know you have already made some state- 
ments — what do you think it says about a system such as ours 
today that reports an obviously living person as dead, and then you 
cannot get the error corrected? 

Mr. Jokinen. I even asked Chase on the phone if they could 
prove that I was dead. I can prove that I am alive. And I asked 
them if they had a corpus delicti in a coldroom someplace, because 
I would like to come and match fingerprints, because I have been 
fingerprinted for 40 to 50 years, with all kinds of files, and they 
are always the same, so what do they have? 

Chairman Shelby. A writ of habeas corpus would produce a 
body, wouldn’t it? 

Mr. Jokinen. Yes, that is right. 

Chairman Shelby. If you were breathing, you would be all right. 

Mr. Jokinen. Yes, exactly, and it got to that point, and still they 
did not correct it. 

Mr. Hendricks. And Senator, I think it raises serious concerns. 
The truism is circulating that this is the best system, which it is, 
or as Churchill said, “the worst except for all the rest.” 

I am seeing signs of breakdowns like this on such a regular basis 
that I think we need a really deep, drilled-down look into the accu- 
racy problem, and you have to wonder if there is a correlation to 
skyrocketing bankruptcy. Aren’t these systems supposed to predict 
that so we do not have it, yet from the mid-1990’s on, the bank- 
ruptcy rate has really gone up, and we need research on that. 

Mr. Pratt. Again, I would just like to add that in our testimony, 
we talk about how 16 million consumers look at their files every 
year, and less than half of them ever call back. So one of my con- 
cerns is about the difference between how we learn from certain 
patterns or even individual experiences, and the difference between 
that and the performance of the industry on a day-to-day basis, a 
week-to-week basis, a year-to-year basis in terms of how well the 
system does work. 
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You do not have to try to reconcile those, because each is true. 
We need to learn from those individual experiences and make 
changes and improvements. And every year, the industry at the as- 
sociation level, through data format standards, which can be 
changed — for example, bankruptcy issues, Evan, that you raised in 
your testimony, the new format allows for better, more precise re- 
porting. Some of that cannot be anticipated — we cannot be abso- 
lutely prescient about the future — so it is evolutionary, and you 
change over time with that thing. 

Now, if we could get everybody on the new format, we would 
have better data than the data on the old format. I think Richard 
would agree with that as well. 

Mr. LeFebvre. Absolutely. 

Mr. Pratt. But it is a voluntary system, and there are certain 
aspects of this, Mr. Chairman, that we can control. We cannot have 
access to the Social Security Administration — there are lots of good 
reasons for that — but that would allow us to authenticate whether 
or not somebody’s Social Security number is really correct. 

Chairman Shelby. Then we would need IRS records, right? 

Mr. Pratt. It is dangerous to ask for access to a lot of Govern- 
ment data. 

Chairman Shelby. Resellers see each report that the big three 
bureaus prepare on consumers. This provides them a unique van- 
tage point to get an understanding with respect to the accuracy of 
reports. The Banking staff contacted some resellers to get a sense 
as to some of the issues they come across. In a period of less than 
a week, the resellers found 13 files that contained inaccurate, de- 
linquency information. Correcting these inaccuracies resulted in 
FICO score changes that ranged between 6 and 80 points. They 
found 13 files that required correction of information related to 
bankruptcy filings. These corrections resulted in FICO score 
changes that ranged from 18 to 108 points. They found a file with 
a fraudulent credit card account that, when removed, resulted in 
a 105-point FICO score increase. 

While these are some anecdotes collected over a limited period of 
time, the results are interesting. From your experience, sir, how 
representative do you think these reports are? 

Mr. LeFebvre. Senator Shelby, I was one of the first resellers 
back in 1998 who was allowed to rescore. In 5 years, the numbers 
that you have quoted are absolutely right on, if not higher. If you 
can remove the inaccuracy or get all three bureaus to agree on the 
same thing, scores dramatically go up. The more recent the inaccu- 
racy removed, the more positive impact it has. 

Chairman Shelby. If the consumers whose credit reports I was 
referencing containing these errors had not been trying to obtain, 
let us say, mortgages on their homes or business, and had not had 
merged files prepared, is it likely they would have come across 
these errors? 

Mr. LeFebvre. Absolutely not. 

Chairman Shelby. Mr. Pratt, I want to come back to you again. 
In your written testimony, you indicate that — and I will quote — 
“Accuracy of reports is elemental.” That is true. It is elemental. 
The whole system requires accurate reports. We all, I think, agree 
to that. 
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Later in your testimony, Mr. Pratt, you indicate — and I quote 
again — “We could do an even better job if everyone used our newest 
data standard and also if every one of the 30,000 furnishers of in- 
formation would also use the online system for processing con- 
sumer disputes.” I believe those were your words. 

Mr. Pratt. Yes, sir. 

Chairman Shelby. I assume that by “we,” you mean the credit 
repositories. 

Mr. Pratt. Yes — although when you look at-large at the commu- 
nity of furnishers who are providing data, I do not think you would 
find a single executive in a company who will say, “My goal is to 
report bad data” or to declare somebody dead. But in the bigger 
picture, yes, the more we can run through the automated process — 
and I think Evan has made a couple of comments about one of the 
challenges of automation is that you have to automate, you have 
to communicate — in fact, the law required in 1996 that we build an 
automated system under FCRA to allow for error correction so that 
I could correct my error just once. It used to be historically that 
I could correct it in one file, and then it would be in another file, 
and I would not find out until later. 

So one of the challenges was to — and, in fact, lenders were obli- 
gated to report corrections to all nationwide consumer reporting 
agencies — it is always a challenge to try to convey with absolute 
precision the nature of the consumer’s dispute, at the same time 
to do it quickly, at the same time to get it done in 30 days, and 
at the same time to handle 

Chairman Shelby. Quickly and accurately. 

Mr. Pratt. Yes, sir, quickly and accurately — do not work co- 
terminously all the time. We do have that challenge of doing both, 
yes, sir. 

Chairman Shelby. By the word “better,” I also assume you mean 
more accurate. 

Mr. Pratt. We definitely could be more accurate if that were the 
case. 

Chairman Shelby. Okay. 

Mr. Brobeck, I have raised the issue that we do not have a firm 
handle on the true level of accuracy in the system at this point in 
time. While your study provides — and I thought your study was 
very interesting — a sense of where things are right now, don’t we 
need to be better-informed about this issue in the future? 

Mr. Brobeck. Yes. We know that at least a significant minority 
of consumers can be adversely impacted by inaccurate scores, even 
annually. We cannot at this point assign a specific number — 

Chairman Shelby. An inaccurate score will cost you over time 
possibly hundreds of thousands of dollars. 

Mr. Brobeck. Yes, sir, it could — if, for example, you purchase a 
subprime mortgage instead of a conventional mortgage, it could 
cost you well over $100,000. 

We would agree with the recommendation that a Federal Agency, 
perhaps the FTC, should be given the authority and the responsi- 
bility to continuously monitor this issue and also assume some re- 
sponsibility for reviewing the dispute resolution process. 

Chairman Shelby. I think it is very, very important. 
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Gentlemen, we have a lot of questions, as I said, for the record 
as we huild this record. And I think we have a great opportunity 
here in the Banking Committee, here in the Senate and the House, 
to put together a comprehensive bill that will be good for the econ- 
omy, that will be good for the financial services industry, but will 
be good for the American people. 

Mr. JOKINEN. Mr. Shelby, if I may. 

Chairman Shelby. Yes, sir. 

Mr. JoKiNEN. This has been the best day I have had in over 2 
years. Thank you. 

Chairman Shelby. Thank you — and I want to say this — I will 
sign an affidavit — I believe you are very alive. 

[Laughter.] 

Chairman Shelby. The hearing is adjourned. 

[Whereupon, at 1:12 p.m., the hearing was adjourned.] 

[Prepared statements, response to written questions, and addi- 
tional material supplied for the record follow:] 
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PREPARED STATEMENT OF SENATOR RICHARD C. SHELBY 

This morning, we take up one of the most important issues, if not the most impor- 
tant, associated with the FCRA: The accuracy of the information contained in con- 
sumer credit reports. 

Changes in our financial services industries have made accuracy more important 
than ever. Credit report information is increasingly used as the key determinant of 
the cost of credit or insurance. 

By way of risk-based pricing, gone are the days when lenders merely lumped bor- 
rowers into the “qualified” or “unqualified” category. The use of risk-based pricing 
allows lenders to extend credit to a broader range of borrowers predicated on the 
assumption that borrowers receive credit terms which are commensurate with the 
credit risk they pose. 

As a result, credit report information has a direct impact on the amount and the 
interest rates at which credit is offered. With respect to large credit transactions, 
such as mortgages, rate differences can translate into hundreds of thousands of dol- 
lars over the course of a loan. 

Even in smaller dollar credit transactions, such as credit cards, rate differences 
can mean large amounts of money. Furthermore, with the practice of credit card 
companies reviewing credit reports and adjusting rates in real time becoming more 
prevalent, the application of risk-based pricing to consumer finances is practically 
an every day event. Let me try to further illustrate these points. 

This first chart provides some rough indication as to the effects that particular 
entries on a credit report can have on a person’s credit score or credit worthiness. 
As is indicated, some entries, such as a bankruptcy filing can greatly reduce a per- 
son’s credit worthiness. There is nothing wrong with this; consumers who have 
failed to pay their debts DO pose a considerable risk to creditors. 

But what if a bad rating is based on inaccurate information? What if you had 
never been bankrupt and such an item appeared on your credit report? The second 
chart highlights the spreads in interest rates that people with differing credit scores 
would pay for some sample products. As the chart shows, the differences are very 
real. So are the financial consequences. Consider the cost differences for a $200,000, 
30-year fixed mortgage. A borrower classified as a “marginal” risk pays almost 
$90,000 more in interest than someone with an “excellent” credit rating. Someone 
classified as a “poor” credit risk would pay $124,000 more in interest than the per- 
son with “excellent” credit. 

Credit rating matters for other transactions as well. Someone financing a $24,000 
new car with a “marginal” rating can expect to pay 127 percent more in interest 
(about $3,300) than a person with “excellent” credit. Someone with “poor” credit can 
expect to pay 255 percent more in interest (about $6,700). Again, what if the infor- 
mation that leads to a bad credit rating is inaccurate? 

With the rewards for good credit so meaningful, and the penalties for bad credit 
so severe, it is absolutely critical that credit reports accurately portray consumers’ 
true credit histories. 

Thus, the focus of today’s hearing — examining the FCRA and the operation of our 
credit markets to determine whether or not the present system provides optimum 
accuracy. 

With a system as large and complex as ours, involving the transfer of billions of 
pieces of information, it is almost a certainty that there are going to be some errors 
which occur. On the other hand, the credit reporting agencies are paid to properly 
handle the data. 

And furnishers, who also happen to be the largest consumers of credit report in- 
formation, take advantage of the efficiencies provided by the system. Both derive 
significant benefits from this system. Both also have a significant responsibility to 
get things right. 

So let us consider: How and why do errors occur in credit reporting? Can more 
be done to prevent errors in the first place? If some errors are not preventable, does 
the system enable them to be quickly recognized? Who most efficiently recognizes 
them? Once recognized, does the system work to ensure that errors are quickly cor- 
rected? 

I look forward to examining these questions with the witnesses. 
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PREPARED STATEMENT OF SENATOR CHRISTOPHER J. DODD 

Mr. Chairman, I want to thank you for conducting this hearing. Accurate credit 
reporting is essential to the proper functioning of our credit system and to the finan- 
cial security of American consumers. Your strong leadership on this issue is greatly 
appreciated. 

Since its enactment in 1970, the Fair Credit Reporting Act has provided the 
framework within which our credit system has flourished. The vast majority — more 
than 75 percent of all U.S. households, I am told — participate in credit transactions 
that are likely to be the subject of credit checks and credit reports. If it weren’t for 
the ability of credit issuers to quickly determine a consumer’s creditworthiness, 
there is no doubt that less credit would be available to American consumers in gen- 
eral and the economy would suffer. Our modern consumer reporting system serves 
a purpose that benefits both consumers and businesses. 

However, to say that something is useful is not to say that it cannot be improved. 
The credit reporting system can be improved and I look forward to working with 
my colleagues to identify the best ways to ensure that credit reports do not contain 
avoidable errors. What is at stake is too important. Consumer’s financial lives can 
literally be in the hands of the credit reporting agencies and the creditors who pro- 
vide information to those agencies. I believe consumers have a right to expect that 
the information compiled about their financial dealings will be as accurate as is hu- 
manly possible. People will make mistakes — we recognize that. But consumers must 
have a clearly articulated remedy for correcting errors when they to occur. 

A few weeks ago, we heard from a witness named John Harrison, a retired Army 
Captain from Connecticut who was the victim of identity theft. His credit reports 
very clearly contained erroneous information, misinformation that was deliberately 
planted there by a criminal — but Captain Harrison found it very difficult to get the 
bad data out of his reports. He was required to spend hundreds of hours and even- 
tually had to leave his job because trying to clean up his credit was taking so much 
time. That is wrong and we need to fix that problem. 

I am encouraged by some of the Treasury Department’s recent recommendations 
to strengthen the consumer protections contained in the Fair Credit Reporting Act. 
I think, for example, that the Department is right to suggest that consumers should 
have access to free copies of their credit reports and credit scores so they can iden- 
tify problems for themselves. I also agree that we need to strengthen protections 
against fraud, identity theft, and the misuse of consumer credit information. 

Mr. Chairman, thank you for bringing this important issue before the Committee. 
Again, your leadership is greatly appreciated. I look forward to hearing from all of 
our witnesses, and I thank them for being here today. 


PREPARED STATEMENT OF SENATOR DEBBIE STABENOW 

Thank you, Mr. Chairman. Let me begin by saying that I appreciate the very 
thorough and methodical approach you have taken to examining the Fair Credit Re- 
porting Act. I believe it is important that we move in a timely fashion to extend 
the expiring provisions of the Act to ensure that our credit system remains the envy 
of the world. But, I also strongly believe that we must be open to necessary modi- 
fications and improvements in the Act. We have an important opportunity to look 
at what has worked and what hasn’t and to respond to changes in technology, our 
economy, and our ever-evolving understanding of consumers’ needs. 

Today, we are going to be examining the issue of accuracy of credit reports. In 
many ways this is the linch pin in the entire credit-granting system. If we cannot 
assure that this information is correct, it could cost consumers thousands and thou- 
sands of dollars through improperly inflated interest rates. It is, therefore, abso- 
lutely imperative that the companies who furnish credit data be certain that the 
information they keep on all of us is accurate. 

In addition, when that information is not accurate, consumers need a quick and 
easy resolution process. In a fast-paced society like ours, unnecessarily long delays 
in correcting inaccurate credit reports have profound consequences. They can lead 
to denial of a mortgage to buy a home or the steering into a subprime loan. They 
can lead to the inability to get a credit card or an unwarranted increase in interest 
rates on an existing credit card. They can also create reduced work productivity and 
extreme stress as consumers must take off work and spend countless hours trying 
to correct mistakes that occurred through no fault of their own. 

I believe that it is important to ensure that consumers have fair and expedient 
means to address inaccuracies in their credit reports, and I look forward to hearing 
some of the solutions proposed by our witnesses today. 
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Let me also take a moment, Mr. Chairman, if I might, to say that as we prepare 
to mark up FCRA legislation, one other thing that I believe is absolutely essential 
in enhancing the way our credit system works is elevating the financial literacy of 
America’s consumers. While laws and regulations can protect people, one of the 
most powerful weapons we have to protect ourselves from fraud and inaccurate in- 
formation about our finances is education. I want to work with all of my colleagues 
to ensure that, as part of this process, the Federal Government is taking steps to 
improve its efforts on financial literacy. 

Again, I commend you and the Ranking Member, Senator Sarbanes, for your lead- 
ership on this issue. I look forward to hearing from our witnesses today and working 
with all of my colleagues to ensure a timely reauthorization and improvement of the 
Fair Credit Reporting Act. 

Thank you. 


PREPARED STATEMENT OF SENATOR WAYNE ALLARD 

I would like to thank Chairman Shelby for holding this hearing on the accuracy 
of credit report information and the Fair Credit Reporting Act. I am sure it will be 
a helpful part of our ongoing work to reauthorize FCRA. 

Americans have unparalleled access to goods and services, much of which stems 
from the fact that we have the most successful consumer credit system in the world. 
The Fair Credit Reporting Act has been instrumental in expanding the availability 
of consumer credit, which has in turn played a vital role in the U.S. economy. 

The 1996 Amendments improved FCrA’s framework, allowing the free, fair, and 
accurate flow of consumer data. It is now important for us to evaluate and assess 
the successes of, and possible improvements to, this important legislation. 

Examining the accuracy of credit information may be one of the key issues that 
we consider. Inaccurate information is, perhaps, even more problematic than no in- 
formation, for both consumer and lenders. It doesn’t matter if FCRA allows quicker, 
easier, simpler credit decisions if it yields the wrong decisions. 

Further, an inaccurate record of one’s credit history can make even the most sim- 
ple financial transaction or inquiry burdensome or even impossible. Consumers de- 
serve to have their credit history reflected accurately, and credit furnishers and 
credit reporting agencies have the obligation to provide and report accurate informa- 
tion. 

While there may be things we can do to improve the accuracy of the credit report- 
ing system, we will realistically never reach a state of absolutely no errors. I believe 
that one of the strongest antidotes to errors is an informed consumer. In particular, 
I believe that consumer access to credit reports and credit scores will help catch the 
inaccuracies that occur. 

I was pleased to join with Senator Schumer in introducing the Consumer Credit 
Score Disclosure Act of 2003 earlier this week. Our bill would allow mortgage appli- 
cants to receive their credit score, along with other information such as specific fac- 
tors that adversely affected their score. This information will help consumers better 
understand the importance of accuracy in the credit reporting process. I would en- 
courage my colleagues to take a look at the bill and consider adding their name as 
a cosponsor. 

I look forward to hearing from our witnesses today on ways to enhance our cur- 
rent system and ensure the accuracy of people’s credit information. 
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Mister Chairman and members of the Committee, my name is Timothy J. Muris, and I am 
Chairman of the Federal Trade Commission (“Commission” or “FTC”), I am pleased to present 
the Commission’s views on amending the Fair Credit Reporting Act (“FCRA”).' The 
Commission endorses the FCRA amendments and other statutory changes proposed by the 
Treasury Department on June 30, 2003, including permanent renewal of the uniform national 
standards in Section 624 of the FCRA. 

The national consumer reporting framework the FCRA established has played a central 
role in the expansion of consumer credit, which in turn has contributed so much to the nation’s 
economy. Making the uniform national standards permanent would help ensure the continued 
effectiveness of our national consumer reporting system.^ 

At the same time, it is critical that our credit system protect the rights of consumers in the 
privacy, security, and accuracy of their financial information. More types of businesses are 
using consumer reports than ever before. The Commission supports the legislative amendments 
proposed by the Treasury Department, which provide important protections for consumers. The 
proposals include: 


' The written statement represents the views of the Federal Trade Commission. My oral 

presentation and responses are my own and do not necessarily reflect the views of the Commission or of 
any other Commissioner. 

It is important to keep in mind that, notwithstanding its title, the Fair Credit Reporting 
Act has always covered more than what are conventionally termed “credit reports.” It applies generally 
to any information collected and used for the purpose of evaluating consumers’ eligibility for products 
and services that they want. Thus, the FCRA has always applied to insurance, employment, and other 
non-credit consumer transactions. See FCRA § 602(b) (“It is the purpose of this title to require that 
consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for 
consumer credit, personnel, insurance, and other information . . . .”). The focus here will be on credit 
reporting, but the same basic regulatory structure applies to all consumer reports. Throughout this 
testimony, we will refer to “consumer reports” rather than “credit reports,” although the terms are used 
interchangeably and either usage is correct. 
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• provisions aimed at helping consumers prevent, detect, and mitigate the harms that result 
from identity theft;'’ 

• free annual access to consumer reports and better infomiation about credit scores for 
consumers; and 

• enhanced rights to adverse action notices that better comport with modern credit 
practices. 

The Commission recommends two additional FCRA amendments: ( 1 ) a modest strengthening of 
the duties of information furnishers and (2) changes to the obligations of employers when 
investigating employees. 

I. Economic Growth, Consumer Reporting, and the FCRA* 

The enactment of the FCRA in 1 970, and its amendment in 1 996, have fostered the 
development of our modem credit system. Consumer spending accounts for over two-thirds of 
U.S. gross domestic product, and the wide availability of affordable credit drives this spending.’ 
In 2001, 75 percent of U.S. households participated in the consumer and mortgage credit 
markets.® Well-functioning credit markets are an essential component of economic prosperity. 


’ Identity theft occurs when someone commits fraud or other unlawful activity by using 

another person's identifying information, such as date of birth, social security number, or credit account 
numbers. The fraud could include applying for or using credit in another's name, obtaining bank loans, 
employment, or utility services (including cell phones), or similar illegal conduct using the identity of the 
consumer whose information was misappropriated. 

* For a more extended discussion and detailed history on these related topics, please see the 
Commission’s May 20, 2003 testimony before this Committee at hltD://www. senate. gov/ 

%7Ebanking/03 05hrg/05 1 SOB/beales'pdf . 

’ In 1946, total outstanding consumer credit stood at $55 billion; by 1970, the time of 
enactment of the FCRA, it had grown to $556 billion. [Figures adjusted for inflation.] Today, it is $7 
trillion. See Fred H. Cate, Robert E. Litan, Michael Staten, and Peter Wallison, “Financial Privacy, 
Consumer Prosperity, and the Public Good: Maintaining the Balance,” AEI-Brookings Joint Center for 
Regulatory Studies, March 2003, at 1, 8. 


Id. at 2. 
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The modernization of consumer reporting has played a key role in providing U.S. 
consumers with rapid access to consumer credit. Federal Reserve Chairman Alan Greenspan 
noted the benefits of this system to both consumers and lenders in his April testimony to tire 
House Financial Services Committee.^ The development of a national consumer reporting 
system, with its sophisticated risk models and automated underwriting, has contributed greatly to 
making credit more widely, inexpensively, and rapidly available.^ The national system also has 
narrowed the gap in credit availability between high and low income consumers.^ 

The information in the consumer reporting system is derived from creditors, insurers, and 
others (also called ‘Tumishers”) that voluntarily report account histories to consumer reporting 


^ “So it is clearly in the interests of consumers to have information continuously flowing 
into [credit] markets. It keeps credit available to everybody, including the most marginal buyers. It keeps 
interest rates lower than they would otherwise be because the uncertainties which would be required 
otherwise will not be there.” Remarks following testimony by Alan Greenspan, Chairman of the Board of 
Governors of the Federal Reserve System, April 30, 2003, House Financial Services Committee, at 


^ “By most accounts, the consumer credit marketplace in the United States is the envy of 
the world. In 30 short years, balkanized local credit card markets, characterized by high and largely 
undifferentiated prices on credit, very subjective application processes, and limited access, have evolved 
into a national consumer credit marketplace distinguished by dynamic competition among lenders and 
broad participation by most American consumers.” Information Policy Institute, “The Fair Credit 
Reporting Act; Access, Efficiency & Opportunity - The Economic Importance of Fair Credit 
Reauthorization” (June 2003; hereafter, “IPI Report”) at page 5. See also Testimony of Michael A. 
Turner, Ph.D, President and Senior Scholar, The Information Policy Institute, before the House 
Committee on Financial Services, Subcommittee on Financial Institutions and Consumer Credit, May 8, 
2003 (hereafter, “Turner testimony”). 

^ Preliminary research indicates that advances in risk modeling sophistication and use 

have led to increased economic activity (such as homeownership rates and use of credit) and especially 
significant benefits for disadvantaged groups. For example, from 1970, when the FCRA was passed, to 
2001 , the percentage of families in the lowest income quintile with a credit card increased from 2 percent 
to 38 percent. IPI Report, at 5; Turner testimony, at 4. See also, Cate, “Privacy, Consumer Credit, and the 
Regulation of Personal Information,” in The Impact of Public Policy on Consumer Credit, Thomas A. 
Durkin and Michael E. Staten, eds. (Boston: Kluwer Academic Publishers, 2002), at 235-36. 
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agencies (“CRAs”).'“ The flow of information between furnishers, CRAs, and consumer report 
users, as governed by the FCRA, facilitates more expeditious and accurate credit decisions." 

11. Proposed Legislative Action 

The Commission supports the Treasury Department’s proposals for amending the FCRA. 
We believe these proposals would (1) ensure the continuing viability of the FCRA’s uniform 
national framework that has been a cornerstone of our consumer credit-driven economy, and (2) 
improve the FCRA to the benefit of consumers, especially in preventing and mitigating the 
ravages of identity theft and other fraud. We also support the related initiatives to combat 
identity theft, and recommend two further legislative refinements to the FCRA. 

A. Making the FCRA’s uniform national standards permanent 

The FCRA currently provides uniform standards and preempts state laws with respect to 
(1) the prescreening of consumer reports, (2) the time within which CRAs must investigate 
consumer disputes, (3) the adverse action duties of users of consumer reports, (4) the duties of 
furnishers, (5) the age of information allowed in consumer reports, (6) the exchange of 
information among affiliated companies, and (7) certain consumer disclosures. The impact of 
removing the uniform national standards might not be the same for each standard, and of course 
would depend on what actions individual states decided to take. Nonetheless, the entire package 


CRA.S are also referred to “credit bureaus.” 

Each of the three national CRAs (often referred to as the “Big 3") receives more than 2 
billion items of information each month. See “An Overview of Consumer Data and Credit Reporting,” 
Federal Reserve Bulletin. February 2003, at 49. 

" CRAs issue between 2 and 3 million consumer reports each day. See 
httD://www.cdiaonline.org/ahoiit.cfm . 
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of national standards mandated by Congress in 19% has proven effective. Accordingly, the 
Commission recommends that all of the standards be made permanent. 

Because information reporting is voluntary, the entire system depends on cooperation. 
The 1996 amendments established a balance — imposing important responsibilities on furnishers 
with respect to the information they provide, but not making those duties so onerous that 
furnishers report more selectively or stop entirely. Allowing the uniform national standards to 
expire would risk upsetting this balance. 

The Commission believes that the national character of our credit markets is a powerful 
argument for retaining the uniform standards. The current system functions well, and we believe 
there is no compelling justification for fundamental changes. The FCRA forms the baseline of 
consumer protections that the marketplace has now incorporated into its thinking and behavior. 

This is not to say that the FCRA is perfect; in the Commission’s view, the amendments 
discussed in tliis testimony would improve the Act. The Commission believes, however, that 
both businesses and consumers would best benefit from improvements made at the national 
level. Indeed, the Commission has a number of recommendations to strengthen the expiring 
national standards. We propose, among other things, improving the prescreening process to 
enhance opt-out rights, streamlining the investigation duties of CRAs that resell consumer 
reports, expanding consumers’ rights to adverse action notices, requiring furnishers to 
reinvestigate disputes received directly from consumers, and improving consumer disclosures 
with respect to credit scoring. 

To the extent that states are allowed to promulgate different standards than those in the 
FCRA, the resulting inconsistency could undermine the value of predictive models without a 
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countervailing consumer benefit. For example, one result might be a reduction in the 
information available to the consumer reporting system. A robust credit information database is 
critical to creditors offering credit as broadly as possible at the lowest cost.’’ In general, the 
credit markets are best positioned to determine the type and quantity of information needed to 
make credit decisions. 

Moreover, if states could pass differing laws that imposed additional duties on furnishers, 
who now provide information voluntarily, fewer furnishers might report or they might report less 
information, thereby degrading the quality of the data upon which decisions are made. Similarly, 
if states were free to shorten reinvestigation time limits, furnishers might determine that their 
reinvestigation duties were too onerous and simply exit the system. By the same token, state 
enactment of shorter data obsolescence periods, governing how long negative information can 
continue to be reported, would necessarily reduce the amount of data in consumer reports. The 
result would be to restrict creditors’ ability to consider information that may be predictive of 
risk.^^ 


IPl Report, at pages 40-53. See also Turner testimony, at 4: “Full-file credit reporting, 
made possible by the preemptive provisions of the FCRA, enables lenders to distinguish different degrees 
of risk far better than older, less sophisticated techniques.” 

If the states had different obsolescence standards, CRAs would have to implement 
different retention and deletion procedures for consumers in each such state, and when a consumer moved 
from one state to another, the file would have to be adjusted. Given the high degree of transience and 
consumers with more than one address (e.g., students or retirees), the effect of one state’s enactment of a 
more restrictive obsolescence standard would inevitably aftect consumers beyond that state’s borders. 
While CRAs could adopt the most restrictive obsolescence standard and apply it nationally for ease of 
compliance, that would result in a costly loss of data to lenders nationwide. Those lenders who operate 
only in the state with a restrictive obsolescence standard would lose data necessary to assess risk 
accurately - they would not be able to spot the poor risks as easily, which would increase their credit 
losses, requiring them to raise prices for everyone, including the good risks. Multistate lenders might be 
able to charge lower prices, but only by spreading their increased losses to their customer base in other 
states, with the net effect that consumers elsewhere would subsidize the consumers in the state with the 
most restrictive obsolescence standard. 
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Preliminary research indicates that allowing tlie national standards to expire could have 
deleterious effects for consumers. One study measures the impact of different scenarios of 
possible state regulation on credit score modeling and, ultimately, on the cost and availability of 
credit. The results suggest that the hypothesized changes in FCRA standards would alter most 
consumers’ credit scores and low'er the predictive power of scoring models, leading to increased 
delinquency rates or (to maintain current delinquency rates) re.stricted availability of credit.'” 

B. Improving the FCRA - the Treasury Department’s proposals 

In conjunction with making permanent the uniform national standards, the Commission 
supports the following proposals to amend the FCRA, which would provide important 
protections for consumers. 

1. Access to free eonsumer reports and credit score information 

Currently, under the FCRA consumers are entitled a free consumer report only under 
limited circumstances.” The Commission supports amending the FCRA so that consumers have 
the right to request a free consumer report annually. In addition, the Commission supports a 
requirement that the report be accompanied by information on how credit scores are derived and 
what consumers can do to improve them.'^ These proposals would (a) enhance consumers’ 

IPI Report, at 45-5 1 . The state law changes hypothesized included changes to the FCRA 
standards for prescreened offers, furnisher obligations, and the content of consumer reports. 

Currently, free reports are available pursuant to the FCRA when the consumer suffers 
adverse action, believes that fraudulent information may be in his or her credit file, is unemployed, or is 
on welfare. See FCRA § 61 2. In addition, a small number of states require the CRAs to provide free 
annual reports to consumers at their request. Absent one of these exceptions, consumers must pay a 
statutory “reasonable charge” for a file disclosure; this fee is set each year by the Commission and is 
currently $9. FCRA § 612(a). 

Scores are widely used by creditors and insurers to evaluate consumers, and are based on 
analyses of historical consumer credit data, which allow creditors to develop models that help them 
predict the risk of default of a particular consumer. (The products are thus sometimes referred to as “risk 
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ability to discover and correct errors, thereby improving the accuracy of the system; (b) educate 
consumers about the importance of consumer reports and scores and how to improve them; and 
(c) in some cases provide an early alert to identity theft victims about crimes committed in their 
names. In an environment with consumer reports and scores used more and more frequently in 
eligibility and pricing decisions for a myriad of products and services, consumers’ knowledge of 
their credit records is crucial. 

2. National fraud alert system 

The Commission supports standardizing the means by which consumers who reasonably 
suspect they have been or may be victimized by identity theft, or who are military personnel on 
active duty away fi'om home, can place an alert on their credit files. The alert would put 
potential creditors on notice that they should proceed with caution when granting credit in the 
consumer’s name. The proposal would also codify and standardize the “joint fraud alert” policy 
whereby an identity theft victim only needs to call one national CRA to place a fraud alert and 
obtain a free consumer report from all three. The three major CRAs voluntarily follow these 
procedures now (except for the military alert). The Commission supports the codification of this 
system in the FCRA. 


scores” or “credit scores.”) When the consumer applies for credit or other goods or services, the scoring 
programs that are developed from the complex analysis of past data compare the scoring factors to the 
individual information of the particular consumer, with the result reflected in a score that is generated for 
that application. 
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3. Identity theft account blocking 

The Treasury Department’s proposal would require CRAs immediately to cease 
reporting (“block”) allegedly fraudulent account information on consumer reports when the 
consumer submits a police report or similar document, unless there is reason to believe the report 
is false. Blocking would mitigate the harm to consumers’ credit record that can result from 
identity theft. We understand that the three major CRAs do this voluntarily now, and 
recommend that it be codified in the FCRA. 

4. Reinvestigation duties with respect to resellers 

Persons who piuchase consumer reports for resale (also known as “resellers”) are 
covered by the FCRA as consumer reporting agencies and have all the obligations of other 
CRAs, including the duty to reinvestigate information disputed by consumers. Typically, 
resellers combine information from the three major CRAs (also sometimes referred to as 
“repositories” in this context) to produce reports for mortgage lenders. Resellers are an 
important source of consumer reports, but the current FCRA dispute obligations of CRAs and 
furnishers do not work well when applied to resellers. The Commission supports amending the 
FCRA to better address reinvestigation duties when a reseller is involved. If a consumer 
disputes infonnation in the report, the reseller may meet resistance in getting the creditor who 
originally furnished the information to investigate the dispute, because the creditor has no 
relationship with the reseller. Yet, if the reseller sends the dispute to the relevant repository, that 
repository currently has no legal obligation to reinvestigate, because the dispute did not come 
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directly from the consumer. The Commission supports an amendment that would require 
resellers to submit disputes to the originating repository and the source furnisher to investigate 
these disputes. Such an amendment would ensure that the dispute process functions more 
efficiently. 

5. FTC rulemaking on adverse action notices 

The FCRA requires that when adverse action is taken against a consumer based even in 
part on a consumer report,'* the user must notify the consumer of (1 ) the identity of the CRA 
from which the creditor obtained the report; (2) the right to obtain a free copy of the report; and 
(3) the right to dispute the accuracy of information in the report. Adverse action notices are a 
critical first step in the “self help” system for correcting inaccuracies in the consumer reporting 
system. Consumers are in the best position to know whether the data in their consumer reports 
are accurate. The adverse action notice informs a consumer that a denial was based, at least in 
part, on the report. With the notice, consumers have specific incentives to correct inaccurate 
data. 


'' If the consumer is told by the reseller that he must dispute the information to the source 
repository, this delays the dispute process. Time is often of the essence in the case of a mortgage 
application. 


“Adverse action” generally means any action that is adverse to the interests of the 
consumer, and can include a denial of credit, denial of an apartment rental, or denial of a retail purchase 
by check. In the insurance context, “adverse action” means “a denial or cancellation of, an increase in 
any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount 
of, any insurance.” In the employment context, the term includes “a denial of employment or any other 
decision for employment purposes that adversely affects any current or prospective employee.” See 
FCRA § 603(k). 
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Currently, the definition of “adverse action” for credit transactions is imported into the 
FCRA from the Equal Credit Opportunity Act (“ECOA”).’’ Under the ECOA definition, there is 
no adverse action in many situations when the consumer is offered less favorable terms, such as 
a higher interest rate, because of information in her consumer report. For example, there is no 
adverse action when the consumer accepts a “counteroffer” that includes those less favorable 
terms. The ECOA definition does not adequately address modern credit markets, in which 
consumers do not necessarily apply for specific credit terms, but rather for the best terms for 
which they can qualify. In turn, creditors offer terms tailored to the consumer’s risk profile, 
which may often mean a higher price than would otherwise have been the case but for the 
consumer’s consumer report. Yet, under current law, consumers who accept this higher price 
would not receive an adverse action notice, and thus would never know about a problem in the 
consumer report that caused the higher price. We support the proposal to grant specific 
rulemaking authority to the FTC to address the definition of adverse action in credit transactions 
to better reflect the modern credit market,™ 

6. Improving opt-out notices for pre-screened offers 
Prescreened offers provide many benefits for consumers, and can enhance competition, 
leading to greater credit availability, better terms, and lower costs for consumers.^' At the same 
time, the 1996 amendments appropriately gave consumers the right to opt-out of receiving such 
offers, and required that creditors and insurers clearly and conspicuously disclose this right in the 

The ECOA adverse action definition is not imported into the FCRA with respect to 
insurance or other noncredit transactions. 

Currently, the Commission has no rulemaking authority with respect to the FCRA. 


2 \ 


IPI Report, at 54-59. 
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offer itself. The Commission has observed that these notices in many cases have been buried in 
locations difficult to find, and that the language of the notice is often difficult to understand. The 
Commission supports the proposed amendment to the FCRA directing the Commission and bank 
regulators to clarify and strengthen the opt-out notice requirements. A regulatory proceeding 
would allow the agencies to provide more specific direction on this requirement, based on 
empirical evidence of the costs and benefits of various disclosure options and their effectiveness 
in communicating to consumers. 

C. Other Treasury Department legislative proposals 

The Commission also supports the non-FCRA proposals to prevent identity theft, limit 
the damage from that crime, and help victims restore their reputations. 

1. Truncation of credit and debit card receipts 

In many instances, identity theft results from thieves obtaining access to card numbers on 
receipts. This source of fraud could be reduced by requiring merchants to truncate (i.e., print 
less than the full card number on the receipt). The use of truncation technology is becoming 
widespread, and some card issuers already require merchants to truncate. The Commission 
supports requiring truncation, but recommends that the law be phased in over a period of time to 
allow for the replacement of existing equipment. 

2. Enhanced criminal penalties for identity theft 

One way to deter identity theft is to make it easier to prosecute. Legislation proposed last 
year would have created a new crime of “aggravated identity theft,” with stiff penalties and 
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streamlined proof provisions. The Commission continues to support that proposal.” 

3. “Red flag” indicators of identity theft 

The Treasuiy Department’s proposal would direct banking regulators to identify and 
maintain a list of “red flag” indicators of identity theft and provide the list to financial 
institutions they regulate. Banking regulators also would be required to examine the institutions 
for use of red flag indicators, with authority to assess fines when an institution’s failure to use 
the indicators causes losses to customers. The goal of this proposal is to give financial 
institutions up-to-date information on identity theft patterns and practices and to encourage them 
to take action to prevent this crime. The proposal seeks to achieve this goal through the bank 
examination process, in which the regulators and the regulated entities can share information.^ 
The Commission supports this proposal. 

4. Information sharing by debt collectors and creditors with identity theft 
victims 

Some identity theft victims have complained that debt collectors and creditors refuse to 
tell them about accounts opened in their names. The Treasury Department’s proposal would 
authorize debt collectors and creditors to share with a victim the infonnation they have on 


Testimony of Howard Beales Before the Technology, Terrorism, and Government 
Information Subcommittee of the Senate Judiciary Committee, July 9, 2002, at httD://www. ftc.gov/ 
os/2002/07/beaiesidlhefttestimonv.htm . 

Attention to identity theft “red flags” would seem readily amenable to the bank 
examination process. Any exam requirements should remain flexible to respond to unforeseen 
circumstances and changes in the pattern of identity theft. 
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allegedly fraudulent accounts in the victim’s name. This information may help victims clear their 
names.“ 

5. Keeping fraudulent debt from being transferred or reported 

The Treasury Department proposes legislation requiring a debt collector to notify the 
creditor when it learns that an account it is collecting is fraudulent. In turn, a creditor, once it 
learns that an identity theft caused a debt, would be prohibited from selling or transferring the 
debt for collection, and from reintroducing the fraudulent information into a consumer report. 
Some identity theft victims complain that bad data reappear on their consumer reports long after 
they have had them removed, and it appears that creditors may be partly responsible - tliey may 
sell debts or place them for collection, even after they should know they are fraudulent. 

D. Improving the FCRA - the Commission’s additional proposals 
1. Duty of furnishers to respond to disputes direeted to them 

Under Section 623(b) of the FCRA, furnishers have a duty to investigate only disputes 
that are sent to them from a CRA.“ Unfortunately, many consumers who learn about errors in 
their report may contact the furnisher directly, and may not know that they must notify the CRA 
to trigger the furnisher’s obligation to investigate. The result may be confusion and delay in 


‘ Identity theft victims tell us that it is often helpful to obtain application information on 

fraudulent accounts as a part of their own investigation into the circumstances of the theft. For example, 
they might recognize the handwriting on the application or be able to prove that it is not their own. 

In practice, furnishers sometimes investigate disputes received directly from consumers 
because they are required in some circumstances not to report, and to correct, inaccurate information. See 
FCRA §§ 623 (a)(1) and (2). But furnishers have no affirmative obligation to investigate these disputes. 
Thus, if a consumer contacts the creditor only by telephone to dispute, and the creditor previously 
supplied to the consumer an address to submit disputes, it is not liable under FCRA Section 623(a)(1) for 
continuing to report this information, even if it is inaccurate. 
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resolving disputes. The Commission recommends that the FCRA be amended to provide that 
disputes raised with furnishers receive the same treatment as disputes filed with a CRA, 

2. Clarification of the application of the FCRA to investigations of 
employee miseonduct 

The Commission continues to recommend that Congress amend the FCRA to clarify the 
duties of employers with respect to third party investigations of employees.® Since its inception, 
the FCRA has applied to the collection and use of certain information for employment purposes, 
including for workplace misconduct investigations. The 1996 amendments specified that an 
employer cannot (1) obtain an employee’s consumer report for employment purposes without 
written authorization from the employee; or (2) take adverse action based on the report without 
giving a copy of the report to the consumer with a description of the employee’s FCRA rights, 
e.g., to dispute errors. 

These requirements have been criticized by employers and those who perform 
investigations on employers’ behalf as chilling their ability to investigate wrongdoing. The 
Commission shares the concern that the FCRA not unduly hinder workplace investigations, and 
endorses prudent amendments to remove those procedural requirements that unnecessarily 
hamper such investigations.^^ The Commission believes, however, that Congress should retain 


® The Commission testified to this effect before Congress in 2000. See Testimony of 
Debra Valentine Before the Subcommittee on Financial Institutions of the House Banking and Financial 
Services Committee, May 4, 2000, at http://www.ftc.gov/os /2000/05/fcratestimonv.htm . The interaction 
of the FCRA and third-party investigations of workplace misconduct is complex. To understand fully the 
context and implications of proposed changes to the FCRA, we urge careful consideration of the issues 
and legal analysis, which were summarized in the Commission’s earlier testimony. The Commission 
would appreciate the opportunity to work with this Committee and others in Congress to craft an 
appropriate resolution of this issue. 

in its 2000 testimony, the Commission recommended that Congress amend the FCRA to 
remove the requirements that employers (1) obtain the consent of an employee under investigation before 
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the other important privacy and procedural rights the FCRA provides when third parties conduct 
workplace investigations of individuals who have been accused of misconduct."^ 


requesting the employee’s consumer report, (2) give the employee a copy of the consumer report before 
taking adverse action based on the report, and (3) notify the employee that an investigative consumer 
report is being prepared. The Commission also recommended that the FCRA be amended to provide that 
a CRA that prepares an investigative consumer report on an employee suspected of misconduct need only 
provide the employee with a summary of the “nature and substance” of the report, rather than a full 
disclosure of all information in the employee’s file. 

These provisions include the obsolescence provisions of Section 605; the reasonable 
procedures requirements of Sections 606 and 607; the Section 613 requirement regarding accuracy of 
public record information; and the adverse action notice requirements of Section 615. 



421 


III. Conclusion 

In 1970, Congress recognized that “consumer reporting agencies have assumed a vital role 
in assembling and evaluating consumer credit and other information on consumers.”’’ While 
Congress in 1970 may not have envisioned the specific ways in which consumer report 
information would facilitate the development of products and services that ultimately benefit the 
American consumer, the thirty-three years since passage of the Act have fully demonstrated the 
wisdom of Congress in enacting the FCRA. The 1 996 amendments improved the FCRA’s 
carefully balanced framework, making possible the benefits that result from the free, fair, and 
accurate flow of consumer data. The consumer reporting industry, furnishers, and users can all 
rely on the uniform framework of the FCRA in what has become a complex, nationwide business 
of making consumer credit available to a diverse, mobile American public. 

The Federal Trade Commission supports making permanent the uniform standards of 
Section 624 to ensure the continuation of these critical national standards. At the same time, we 
urge the Congress to improve the FCRA and provide other consumer protections as outlined 
above. The Commission looks forw'ard to working with the Committee on these proposals. 
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Section 602(a)(3) of the FCRA. 
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Good morning Chairman Shelby, Ranking Member Sarbanes and all the members of this 
committee. My name is Stephen Brobeck and I am Executive Director of the Consumer 
Federation of America.' 1 appreciate the opportunity to offer our comments on the accuracy of 
credit report infomiation and the Fair Credit Reporting Act. This is an important topic with 
broad implications for consumers. 

As this committee has heard, the credit reporting system in the United States has 
experienced significant technological change in recent years. The good news is that consumers 
have benefited from many of these developments. Credit decisions can be made faster than ever 
before. As new tools for credit risk assessment have been developed - and creditors have 
generated substantial profits by charging higher fees and interest rates for riskier loans - credit 
has been extended to many worthy consumers who in the past might not have been eligible. 

Partly as a result of this development, homeownership in this country has growm. 

During tlie second half of the 1990s, mortgage underwriting increasingly incorporated 
credit scores and other automated evaluations of credit histories. As of 1999, approximately 60 
to 70 percent of all mortgages were underwritten using an automated evaluation of credit, and the 
share was rising^. More recent estimates from industry leader Fair Isaac indicate that 75 percent 
of mortgage lenders and over 90 percent of credit card lenders use its credit scores in making 
credit decisions'*. 

However, there is bad news too. Some lenders extended credit to subprime borrowers in 
an abusive and predatory manner, abusing their new technological capabilities to develop 
usuriously high interest rates and fees carefully targeted at unwitting and vulnerable consumers. 
These lending practices contributed to an unprecedented growth in bad credit card and mortgage 
debt, home foreclosures and personal bankruptcies in recent years. Meanwhile, as subprime 
lending boomed, the Fair Credit Reporting Act’s protections to ensure reporting accuracy, 
protect consumer privacy and prevent identity theft have not kept pace. The increased speed 
with which credit decisions are now made exposes a significant number of consumers to new 
problems and abuses for which old safety measures are inadequate. It is as if the credit reporting 
industry has developed a BMW engine that powers an old Model T car without seat belts, air 
bags and other modem safety features. 

In short, the Fair Credit Reporting Act (FCRA) is in need of an overhaul. This is 
especially true because this nation’s policy is to continue to increase home ownership, 
particularly among minorities. There is a direct connection between the accuracy and 
completeness of credit information that is used about these potential borrowers and whether they 
have access to mortgage loans at affordable and sustainable rates. We have a special societal 
obligation to ensure that mortgage lending to this potential pool of homeowners is granted fairly. 


' Consumer Federation of America is a nonprofit association of 300 pro-consumer organizations that, since 1968, 
has sought to advance the consumer interest through education and advocacy. 

' Straka, John. 2000. A Shift in the Mortgage Landscape: the 1990s Move to Automated Credit Evaluations. 
Journal of Housing Research. Volume 1 1, Issue 2. 

National Consumer Law Center. Fair Credit Reporting. 2002. Page 349. 
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I. Broad and Credible Evidence Demonstrates Serious Problems with Credit Reporting 
Accuracy 

A fair and economically viable credit reporting system requires accurate information. 
Congress has recognized the importance of accuracy in the FCRA. Multiple witnesses who have 
already testified before this committee have indicated that accuracy is a major concern. The 
inclusion of accurate and complete information in consumer credit reports benefits consumers, 
creditors, and score developers. Consumers are in a better position because they are more likely 
to be judged based on the actual risk they pose to a potential lender. Creditors benefit because 
they have a more accurate understanding of the risk posed by consumers and can better compete 
against other lenders. And companies that develop decision tools such as credit scores can make 
those scores more accurate if they have more accurate information with which to develop their 
models. 

Of all of the witnesses who have come before this committee, none have articulated what 
is at stake more concisely than Howard Beales, the Director of the Bureau of Consumer 
Protection at the Federal Trade Commission when he stated, . credit report accuracy was, and 
remains, a core goal of the FCRA. Because even small differences in a consumer’s credit score 
can influence the cost or other terms of the credit offer, or even make the difference between 
getting approved or denied, accuracy of the information underlying the score calculation is 
paramount.” Unfortunately, a broad range of evidence provided by a variety of sources shows 
that inaccurate and incomplete reporting is a persistent, significant problem. 

A. Consumer Federation of America and National Credit Reporting Association Study 
finds dramatic discrepancies in credit scores and underlying credit information among 
credit repositories. 

1 . Credit score variations are very costly to consumers. 

In December 2002, the Consumer Federation of America and the National Credit 
Reporting Association released an exhaustive study of the accuracy of credit scores and the 
credit report information that serves as the foundation for those scores.* Researchers reviewed 
credit report information for a randomly selected sample of more than half a million actual 
consumers (502,623) seeking mortgage credit. Using a layered methodology, CFA and NCRA 
examined three sample groups in increasing detail to assess the impact and likely causes of the 
dramatic discrepancies found in this study. The findings for all three groups were consistent, 
including the typical discrepancies in scores, the frequency of discrepancies of various 
magnitudes and the major explanations offered by lenders for the calculation of creditworthiness. 
To quantify the potential impact of these variations on consumers in the mortgage market, 
researchers closely examined the files of consumers with credit scores near 620, the widely 
recognized standard in the industry separating prime and subprime mortgage candidates. 


Consumer Federation of America and National Credit Reporting Association. Credit Score Accuracy and 
Implications for Consumers. December 2002. Available at: 
htto://wvvw.consumerfed.org/'12]702CFA NCRA Credit Score Report Final. pdf 
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The study found wide variations in the credit scores for a given consumer among the 
three national credit repositories (Experian, Equifax, and Transunion). The average discrepancy 
for all consumers was 41 points, but credit scores for nearly one in three consumers varied by 50 
points or more, and credit scores for one in 25 consumers varied by 1 00 points or more.^ 

The study found that approximately 20 percent of all consumers - about 40 million 
Americans - are at risk for misclassification into the subprime mortgage market because their 
scores are near the 620 pricing cutoff point and vary significantly. Consumers above this pricing 
point receive prime loans with more favorable terms and rates, while consumers with scores 
below it receive less favorable terms and higher interest rates. Roughly eight million consumers 
- one in five of those who are at risk - are likely to be misclassified as sub-prime upon applying 
for a mortgage, based on the study’s review of credit files for errors and inconsistencies. A 
simitar number of consumers are likely to benefit from errors in their reports. However, 
individual consumers do not benefit from system-wide averages and should not have to cope 
with a credit reporting system that functions as a lottery 

Falling below the cutoff score for a prime rate mortgage can place a tremendous financial 
burden on these consumers and make it more difficult to meet this and other financial 
obligations. Interest rates on loans with an “A-” designation, the designation for subprime loans 
just below prime cutoff, can be more than 3.25% higher than prime loans. Thus, over the life of 
a 30 year, $150,000 mortgage*, a boixower who is incorrectly placed into a 9.84% “A-” loan 
would pay $317,516.53 in interest, compared to $193,450.30 in interest payments if that 
borrower obtained a 6,56% prime loan - a difference of $ 1 24,066.23 in interest payments’. 

While these findings are extremely troubling, they actually underestimate the overall 
impact of inaccuracies on consumers in the mortgage market. The CFA study considered a 
single pricing point, 620, and the impact of one dimension of a single transaction, interest paid 
on mortgages. In the purchase of a home, credit scores play a major role in determining the 
availability and cost of homeowners insurance, mortgage insurance (for those with down 
payments of less than 20 percent of the loan) and of utilities and phone service. 

In addition, pricing points are proliferating for many financial services products, putting 
more consumers in harms way. Currently a small discrepancy may not have any impact on 
consumers with higher credit scores, for example in the mid to high 700’ s. But increasingly, 
lenders have a desire to more finely differentiate among consumer classes by creating ever more 
pricing points. Building such a system without data that is precise and accurate enough to 
support these pricing distinctions will put more and more consumers into the credit lottery. 


^ Score discrepancies reflect differences in the underlying credit data collected by each agency, not differences in the 
scoring software they use. All three credit reporting agencies buy virtually the same software from Fair, Isaac, and 
Co. Furthermore, the study determined that score variations could not be attributed to a lag in the adoption of new 
generations of this software. 

^ The Federal Housing Finance Board’s Monthly Interest Rate Survey reports that the national average loan amount 
for conventional home purchase loans closed during June of 2001 was $151,000. 

^ Interest rates as reported by Inside B &C Lending for 30 year Fixed Rate Mortgages for Credit (par pricing), 
and “A” Credit respectively, as of July 14. 
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2. Standardized, generic explanations do not provide sufficient information for 
consumers to address inconsistencies and contradictions, let alone outright errors. 

The study found that approximately seven in ten credit reports indicated that the primary 
factor contributing to the score was “serious delinquency,” “derogatory public record,” or 
“collection filed,” or some combination of these factors, without providing any information 
about which specific accounts were responsible for the lowered scores. In many cases, it was not 
even possible to detemiine which of these extremely broad explanations — delinquency, public 
record, or collection — was responsible for the score. In addition approximately one in six 
reports indicated that the primary reason for the score was that the proportion of revolving 
balances to available revolving credit limits was too high. These tw'o relatively generic 
categories of explanations were reported as the primary reason for a derogatory' score on a total 
of more than seven in ten reports reviewed. 

The vague infonnation provided by these explanations is too general to be helpful. Nearly 
all consumers near the subprime border have had some credit activity that may fall under the 
broad terminology “serious delinquency, derogatory public record, or collection filed.” If their 
credit records were more favorable, they would not be so close to the subprime threshold. Such 
borrowers may accept this generic justification for a low score more readily than consumers with 
generally good credit. Thus, the consumers who are most likely to be penalized by errors are the 
least likely to challenge these imprecise explanations. Because these consumers are not provided 
the specific account information that is lowering their scores, they are not given the tools to 
identify and correct possible errors. The situation would likely be different if consumers had 
access to the full credit reports and the scores used to underwrite their loan applications, with an 
indication of which accounts had the largest negative effect on their scores. If this were the case, 
consiuners would have a much more legitimate opportunity to identify and challenge any errors. 

3. Consumers are harmed by errors of commission and errors of omission. 

A detailed analysis of the types of credit reporting errors that occurred revealed that 
errors of omission (non-reporting of information) and errors of commission (incorrect or 
inconsistent data included in the report) both occurred at significant levels. * 

• Nearly eight in ten files (78 percent) were missing a revolving account in good standing. 

• One in three files (33 percent) was missing a mortgage account that had never been late. 

• Inconsistent reporting by the agencies on whether a consumer was late in making a payment 
was widespread. Wide disparities existed in reporting 30-day delinquencies (on 43 percent 
of files), as well as 60-day (29 percent) and 90-day (24 percent) delays. 

• Reporting on credit limits and balances was almost universally inconsistent (on 96. 1 and 82.4 
percent of files, respectively). This is significant as the proportion of balances to available 
credit was one of the most frequently identified factors affecting a consumer’s credit score. 
One file in six listed the utilization rate as the primary reason for the score. 


The specific findings regarding errors of commission and omission are drawn from the smallest sample examined 
(5 1 files.) The significant characteristics of that small sample are consistent with those of the larger samples in the 
study. Furthermore, many of the findings are consistent with those reported in research by the Federal Reserve and 
other parties. 
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B. Federal Reserve Board Study raises concerns about incomplete and duplicate 
reporting. 

The Federal Reserve Board earlier this year published a comprehensive study examining 
the information in consumer credit reports.^ It found that the information in credit files is not 
complete, that these files may contain duplicate information and at times are ambiguous about 
some consumers’ credit status. The study reviewed the credit information in 248,027 consumer 
credit files from a single national credit repository to determine whether data maintained by 
credit reporting companies is sufficiently complete, comprehensive, and accurate to serve as a 
new source of statistical data to evaluate macroeconomic conditions and for other purposes. This 
study identified several areas of concern regarding the data. 

The primary area of concern with data integrity highlighted in this study was that of 
missing credit limits. About 70 percent of consumers had at least one revolving account in their 
credit files that did not contain information about the credit limit. Without information on the 
credit limit, the level of credit utilization - a key factor used in credit evaluation - cannot be 
determined, and as a result these consumers are likely to be deemed less credit worthy than they 
are. 


The researchers also noted that a large number of accounts had not recently been updated. 
Among accounts reported with a major derogatory piece of information as the most recent 
addition, such as a significant delinquency, almost three-fifths of the reports were not current. 
The researchers concluded that many of these accounts had been closed or transferred, and that it 
was likely that consumers who had paid off delinquent accounts since they were last reported 
were being penalized. 

This report also cites evidence that some creditors only report derogatory infonnation. 
Others do not report minor delinquencies. The impact on consumers of these behaviors is mixed. 
Some may appear more creditworthy as a result, while others may appear less so. 

Consumers may also be penalized by the duplicate reporting of collections and public 
records found in the Federal Reserve study. Items pertaining to the same credit event, such as 
when a new and duplicate record of a delinquency is added at the time a collection is initiated, 
and another added at the time a collection is paid. The report concludes that such duplication of 
these items “could significantly affect credit evaluation.” ° 

Most of the problems identified in the study “result from the failure of creditors, 
collection agencies, or public entities to report or update items.”" In other words, most of the 
problems w'ith incomplete and ambiguous data are the result of the actions of data furnishers. 


^ Avery, Robert, Paui Calem, Glenn Canner, and Raphael Bostic, “An Overview of Consumer Data and Credit 
Repoiting.” Federal Reserve Bullelw. February 2003. pp. 47-73. 

Ibid, at 71. 

"Ibid, at 73. 
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C. The Comptroller of the Currency has publicly admonished furnishers of credit 
information for abusive, unfair, and anti-competitive selective reporting practices. 

In a May 5, 1999 speech before Neighborhood Housing Services of New York, 
Comptroller of the Currency John Hawke stated, “Subprime loans can’t become a vehicle for 
upw'ard mobility if creditors in the broader credit market lack access to consumer credit history. 
Yet, a growing number of subprime lenders have adopted a policy of refusing to report credit 
line and loan payment information to the credit bureaus ~ without letting borrow'ers know about 
it. Some make no bones about their motives: good customers that pay subprirae rates are too 
valuable to lose to their competitors. So they try to keep the identity and history of these 
customers a closely guarded secret”'^. He reiterated these concerns in a June 9, 1999 speech 
before the Consumer Bankers Association, condemning the objectionable practice of non- 
reporting and noting that, “failure to report may not be explicitly illegal. But it can readily be 
characterized as unfair; it may well be deceptive, and - in any context - it’s abusive.”’ ’ 

0. The Federal Finaneial Institutions Examination Council (FFIEC) has raised safety and 
soundness concerns because of selective reporting by furnishers. 

In an advisory letter'*' regarding consumer credit reporting practices, the FFIEC reported 
that “certain large credit card issuers are no longer reporting customer credit lines or high credit 
balances or both. In addition, some lenders as a general practice have not reported any loan 
information on subprime borrowers, including payment records. The Agencies have been 
advised that the lack of reporting is occurring primarily because of intense competition among 
lenders for customers.” Rather than requiring lenders to report more completely, the letter 
provides guidance to financial institutions to take extra measures in their risk analysis to account 
for the missing information, to avoid exposure to credit risk that could affect their safety and 
soundness. 

E. Recent statements confirm that the practice of selective reporting to credit bureaus 
continues to threaten the completeness of information in consumer credit reports. 

Diana Don, a spokeswoman for Capitol One, one of the nation’s largest consumer 
lenders, recently stated in an interview that “Capitol One has never reported credit limits, for 
proprietary reasons.” Explaining why that was the case, Don stated, “We feel that it is part of 
our business strategy and provides competitive advantage.”'’ 

F. Other research confirms high rates of inaccurate and incomplete information in credit 
reports.” 


http://www.occ.treas.gov/ftp/release/99-4 1 a.doc 
* ’ http://www.occ.treas.gov/ftp/reiease/99-51a.doc 
FFIEC Advisory Letter. January' 18,2000. Available at: http:.//ww'w.fllec.gov/press/prOn 800a.htm 
” “FCRA Hearing to Shine Spotlight on Credit Processes'’ American Banker. June 12, 2003 
Ironically, a study conducted for the credit reporting industry that purports to show that very few credit reporting 
inaccuracies exist, may actually demonstrate that consuntei^ who review their reports are likely to find errors. In 
1991, the Associated Credit Bureaus (now the Consumer Data Industry Association) commissioned an analysis from 
Arthur Andersen. This study, completed in 1992, found that very few' consumers who are denied credit request their 
credit reports (7.7 percent or 1 ,223 out of 1 5,703 consumers). However, 25 percent of consumers who reviewed 
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Over the past decade, surveys and research conducted by the Industry Group National 
Association of Independent Credit Reporting Agencies (now the National Credit Reporting 
Association)’’, and by the U.S. Public Interest Research Group'* and Consumers Union” have 
documented inaccuracies in as many as 70 percent of credit reports. Among other problems, 
these studies identified false delinquencies, mistaken identities, uncorrected errors, missing 
information, and duplicate reporting of information in credit reports. 

11. The ability of consumers to identify and dispute inaccuracies in their reports and 

scores is severely limited. 

A. Loopholes in the law and the growth of “risk-based” mortgage lending may endanger 
consumer rights under tlie FCRA to be informed of and challenge adverse credit 
decisions. 

Many consumers do not see their credit reports until they suffer an adverse action based 
on the information in those reports, such as having a loan or insurance application denied, being 
chai'ged higher than prime rates, or receiving less favorable terms, and are told of their right 
under the FCRA to receive a free copy of their credit report. Such adverse action notices are 
usually the catalyst for consumer to exercise their right to review and dispute information in their 
credit reports. However, there are substantial threats to the effectiveness of this pivotal 
component of the statute. The trend towards “risk-based” pricing in the cunent marketplace 
increasingly means that an “adverse offer” is not the wholesale denial of credit, but an offer of 
credit at less than the most favorable terms. For this reason, several of FCRA’s provisions 
regarding adverse actions need to be updated to ensure that consumers have access to their rights 
when they receive a credit offer with higher rates or stricter terms. 

First, a loophole in the law regarding so-called “counteroffers” increasingly reduces the 
efficacy of adverse actions provisions. If a consumer is denied the best credit rate or terms 
available, but accepts an offer for credit at less favorable terms, they are not entitled to a free 
copy of their report, or a notice that they have been subject to an adverse action based on 
information in a consumer report. When applying for a mortgage, many consumers generally 
identify the type of mortgage they would like to apply for and the amount they w'ish to borrow, 
rather than applying for a specific rate. When told about the rate for which they qualify, they are 


their credit reports (304 out of 1,223), found and disputed errors, and 13 percent of disputes that had been completed 
by the time of the study (36 out of 267) resulted in a reversal of the original negative credit decision. The often cited 
finding that this study proves a 0.2% error rate is a somewhat misleading conclusion, because it is arrived at by 
comparing the number of credit reversals with the number of consumers in the sample (36 out of i 5,703). It ignores 
the fact that 92.3% of the consumers in the study never saw their credit reports and were therefore unable to make 
any determination as to their accuracy. Furthermore, the study considers only those errors that were significant 
enough to result In a reversal of the credit denial. Given the sweeping changes in the industry since the study was 
conducted, including the rise of risk-based pricing, the present impact of smaller en'ors on consumers should not be 
overlooked. 

” Survey/Stiidy Three Bureau Merged Tnfile vs. Two Bureau Residential Mortgage Credit Report. National 
Association of Independent Credit Reporting Agencies, March 1994. 

Mistakes Do Happen. Public Interest Research Group. March, 1998. 

” “Credit Reports: How do potential lenders see you?” Consumer Reports. .Iuly2000. P. 52-3,, and “Credit 
Reports: Getting it Half Right.” Consumer Reports. July, 1991. p. 453. 
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not necessarily in a position to assess whether this rate is unfavorable. Furthermore, many 
subprime borrowers are unlikely to be alerted to potential mistakes in their credit files that could 
raise their rate. While increased access to credit is a laudable goal if the loan is not offered on 
predatory terms and it is sustainable by the consumer, this significant change in the marketplace 
requires a re-evaluation of the mechanism and circumstances under which consumers are given 
free access to their credit reports. 

B. The current statute does not provide access for consumers to sufficient information to 
make informed assessments of the impact of errors in credit reports. 

Despite the fact that many lenders may rely heavily or even exclusively on a credit score 
to make a credit decision, the consumer has no right under FCRA to see the score used to 
evaluate them. Moreover, even with notice of an adverse action, the current statutory 
requirements do not give consumers access to the actual information used by a lender to evaluate 
their application. In mortgage lending situations, this usually involves a “tri-merged” report with 
data and scores from all three major credit bureaus. Instead, consumers who request a report 
received a “cleaned up” copy generated by the identifying data the consumer submits, which is 
more detailed than the information that lenders are required to submit. Credit reports are 
generated from large databases of information based on the information included in a query. 
Depending on the amount of identifying information included in the query, the report and credit 
score will be substantially different. In particular, credit files are more likely to include mixed 
information fi'om individuals with similar names, addresses and social security numbers, if very 
little identifying information is used to obtain the file. This incorrect information will not be 
apparent to the consumer if the file he or she receives is different than that received by the 
lender. Moreover, as the findings of the CFA/NCRC report show, the explanations provided to 
consumers about the reasons for adverse credit decisions are usually vague and unhelpftil. 

III. Public Policy Recommendations 

A. Broaden consumer access to credit reporting and scoring information. Empowering 
consumers with more and better information is the key to improving the accuracy and fairness of 
the credit reporting system. 

1 . Require credit reporting agencies to grant consumers one free credit report and credit score per 
year upon request . Rather than waiting for an adverse credit decision to check their report and 
score for accuracy, consumers should be given the opportunity to get the information once a year 
at no charge. Consumers should be given a description of the major factors that are used to 
calculate the score, the weight of each factor in calculating the score and how the consumer rated 
on each major factor. Moreover, consumers should be given a copy of the report a subscriber 
would get, which is generated by less matching information about an individual than a consumer 
is required to submit. This allows the consumer to see if his or her file contains mixed or 
unrelated credit information for someone else with a similar name or address. 

B. Require credit furnishers to provide more accurate and complete information. As this 
testimony has demonstrated, many errors in credit reports can be attributed to the practices of 
creditors and other credit data furnishers. Credit Reporting Agencies must meet a “maximum 
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possible accuracy” standard but obviously rely heavily on the information that is furnished to 
them. 

1 . Increase the legal standard of accuracy for credit furnishers . The current accuracy 
standard under section 623(a)(1)(A) is quite weak and has not provided an adequate incentive 
for data furnishers to provide accurate information. It forbids furnishers from providing data 
to credit bureaus only if “they know or consciously avoid knowing that it is inaccurate.” 
Unlike the requirement in Massachusetts — ^which was allowed to stand when the 1 996 
amendments to FCRA were made — this standard does not require furnishers to know if 
information they are submitting to a credit reporting agency is actually accurate. A standard 
more consistent with many other consumer protection laws would be to forbid furnishers 
from reporting information if they “knew or should have known” it was incorrect. 

2. Require furnishers of data to provide complete information on any account for which they 
use a credit report or score to determine eligibility, pricing or for account reviews . Not all 
providers of consumer services use credit records or credit scores to determine consumer 
eligibility, or pricing. However, those that do should be required to report complete 
information back to the credit repositories, including “positive” payment information and 
information in all data “fields,” including credit limit information and the date of last activity. 
Information about any account that was underwritten with a report from one or more credit 
repositories should be reported to those repositories as frequently as the consumer is 
obligated to make payments. Collection agencies should be required to report on the status 
of collections at least once every six months. 

3. Require data furnishers to notify consumers any time derogatory information is submitted. 
Congressman Ackerman has laudably pointed out that such a requirement would offer 
consumers the opportunity to check the accuracy of derogatory information when it is 
submitted, as opposed to finding out the next time the consumer applies for credit and is 
turned down or offered a high interest rate. 

4. Prevent duplicate reportina of accounts by preventing credit furnishers from reporting a 
debt once it is sold or sent to collection . Collection agencies will report this information 
once they own the account. Credit furnishers should be required to report to credit bureaus 
when they have sold an account and should be forbidden from reporting information about an 
account once they no longer own it. 

C. Require credit bureaus to distribute more accurate information to the users of credit 
reports. 

1 . Require that data provided for credit reports be generated through the accurate matching of at 
least four of points personal information about the specific consumer who is applying for credit . 
The amount and type of identifying information provided by creditors requesting a report should 
be as detailed as that required for consumers requesting their own report or score. This will 
make it more likely that the credit report that is pulled does not contain “mixed” data from 
another consumer with a similar name, social security number or address. 
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2. Require credit bureaus to prevent the reinsertion of fraudulent or erroneous account 
information that has been previously deleted . There have been repeated complaints that 
information that is deleted by a bureau because of an inaccuracy or identity theft is reinserted 
when the data furnisher submits subsequent routine updates of account information. 

D. Modernize the FCRA dispute resolution process. 

1. Allow consumers access to the actual credit report and score that were used to make the credit 
decision . Creditors should immediately provide to any consumer who experiences an adverse 
credit action a copy of the credit reports and scores used to arrive at that decision free of charge 
and permit disputes to be immediately resubmitted for reconsideration. All consumers who have 
experienced an adverse action based on one or more credit reports or scores should immediately 
be given a copy of both the full report or reports used to derive that score and the related credit 
scores without having to pay any additional fee. 

2. Improve tlie explanations offered to consumers for why adverse credit actions are taken and 
offer the consumer the opportunity to correct errors and be immediately reevaluated for the most 
favorable credit terms . The FCRA and Equal Credit Opportunity Act require lenders to inform 
consumers that an adverse credit action has been taken. Such an action includes, among other 
things, denial of credit or the denial of favorable terms on credit. Lenders must also inform 
consumers what the principal reasons are for the adverse action. As cited above, CFA and 
NCRA have found that most of these explanations are either vague, duplicative or both. Instead, 
lenders should be required to identify any specific entries (trade lines) that are lowering the 
consumer’s score and Indicate the impact on the consumer (either the point value deducted for 
that entry or the proportional impact of that entry relative to other derogatory entries in the 
report). The consumer should then be allowed to identify any errors or out of date information, 
provide documentation, and be reevaluated for prime rates. The additional cost to lenders and 
businesses of providing these reports immediately would be minimal. Since they already posses 
the report in paper or electronic form, they would merely have to copy or print this report. 

3. Shorten the deadlines by which creditors must respond to consumer disputes about credit 
information. Currently, the FCRA provides creditors 30 days to respond to a dispute; 45 days if 
the consumer submits additional documentation about the dispute. In the age of “instant credit” 
and three-day credit re-scoring by credit reporting resellers, these deadlines are much too long. 
By the time the consumer hears back from the credit bureau about the outcome of the dispute, he 
or she might have lost a home loan (and the home) or submitted to a loan at a higher rate than he 
or she was entitled to. Given how fast credit decisions are now made, resolution deadlines of ten 
days (fifteen if the consumer submits additional information) do not seem unreasonable. 

4. Require creditors and credit bureaus to meet reasonable minimum standards when 
“reinvestigating” a consumer complaint . As documented in detail testimony before the 
Subcommittee on Financial Institutions and Consumer Credit of the House Financial Services 
Committee by the National Association of Consumer Advocates’” and the National Consumer 


See direct testimony often Bennett, National Association of Consumer Advocates, before the Subcommittee on 
Financial institutions, 4 tune 2003, at http://financialservices,house.gov/mediatpdf/060403Ib.pdf 
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Law Center^', the current automated reinvestigation process used by creditors and bureaus 
almost always results in creditors verifying that the original data they provided about a consumer 
is accurate. Credit bureaus are not required to make an independent determination about whether 
the information that is provided about a dispute is accurate, even if that information comes from 
an independent third party rather than the furnisher or the consumer. They simply submit a 
numerical code to a furnisher about the nature of the complaint and ask the furnisher to verify 
whether the complaint is accurate or not. Creditors are not asked by credit bureaus to examine 
the original documents provided in a dispute to determine their veracity, 

5. Require decisions based on a single repository’s credit report or credit score that result in 
anything less than the most favorable pricing to immediately trigger a re-evaluation based on all 
three repositories at no additional cost . Lenders and other credit data users have a desire to keep 
their underwriting costs low. This is a legitimate desire so long as consumers are not banned in 
the process. Some lenders reduce costs by underwriting certain decisions with only one credit 
report. For example, a lender may offer pre-approved credit cards based on only one report, or 
underwrite home equity lines of credit or second mortgages with a single report. Given the wide 
range between scores for a typical consumer and the frequency with which major accounts are 
omitted from credit reports, such practices have serious negative implications for consumers. 
Measures should be put in place to protect consumers from any negative impact resulting from 
such underwriting practices. A simple solution would be to require all decisions based on credit 
reports to use information from all three repositories. However, this could result in higher costs 
and reduced availability of products such as pre-approval letters that are beneficial to consumers. 
Alternatively, lenders and other credit data users could be permitted to continue underwriting 
based on one report, so long as any adverse impact based on information from a single repository 
immediately triggers a re-evaluation with information from all three repositories at no additional 
cost to the consumer. In this manner, businesses could continue to save on underwriting costs 
for consumers with very good credit, but consumers with less than perfect credit would not be 
forced to continue to pay a high price for inaccuracies, inconsistencies, or incompleteness on any 
one credit report. 

6. Require creditors to identify any offer of credit at less than the most favorable terms as an 
“adverse offer.” This would include pre-screened “subprime” mortgage offers or credit cards 
solicitations that are based on negative or less than favorable credit information. As is well 
known, the subprime credit industry has boomed in the past decade by offering borrowers with 
blemished or limited credit histories mortgage loans, car loans and credit cards at higher rates 
and less favorable terms than offered to their “prime” borrowers. As lenders increasingly offer a 
continuum of loans at different rates and terms, it is more important than ever that consumers 
have the ability to exercise their FCRA rights to insure that adverse credit information is correct. 
In the world of “risk-based” pricing, borrowers should know that they are being targeted because 
of their less than optimal credit history and should be offered the opportunity to check their 
credit history and change any information that is not accurate or complete. Furthermore, as stated 
above, many consumers are unwittingly giving up their FCRA rights because they are accepting 
loans that are legally considered “counteroffers.” 


See direct testimony of Anthony Rodriquez, Staff Attorney, National Consumer iaw Center, before the 
Subcommittee on Financial Institutions, 4 June 2003, at http:/7financialservices.house.gov/media''pdL060403ar.pdf 
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D. Improve oversight of credit scoring. End credit scoring misuse for insurance purposes. 

1 . Establish meaningful oversight of the development of credit scoring systems . Despite the fact 
that consumer access to, and pricing for, vital services such as mortgages, general consumer 
credit, insurance, rental housing, and utilities is increasingly dictated by the automated 
evaluation of credit, there is no government oversight of the design of these systems. The 
calculations behind credit scores, a fact of life for the American consumer, remain shrouded in 
secrecy. The appropriate government agencies, such as HUD, the Federal Trade Commission, 
and state insurance departments should conduct regular, comprehensive evaluations of the 
validity and fairness of all credit scoring systems, including any automated mortgage 
underwriting systems, insurance underwriting systems, tenant and employee screening systems, 
or any other systems or software that uses credit data as part of its evaluation of consumers, and 
report to Congress with its findings. These evaluations should be conducted and released in a 
timely fashion so that score developers can react to any recommendations and so the reviews do 
not become outdated as new versions of scoring software are developed and distributed. Strong 
oversight of scoring systems that identifies and protects consumers from any discrimination or 
abuses will foster consumer confidence in these powerful and increasingly utilized evaluation 
tools, 

2. End the use of credit scoring for insurance purposes . The states of Hawaii and Maryland have 
forbidden the use of credit reporting data for the purpose of underwriting or pricing some forms 
of insurance. This is because insurers have not shown that credit data is logically related to a 
consumer’s likelihood of incurring or filing a claim. These states have rightfully concluded that 
it is not enough to contend, as insurers have, that there is a correlation between credit history and 
claims. There may be a correlation between the color of someone’s hair and their likelihood of 
filing an insurance claim, but that doesn’t mean that it is logical or reasonable to charge people 
witli red hair higher rates, or to refuse to cover them. What does a person’s credit history have to 
do with the likelihood that a hailstorm will damage their roof and that he or she will file an 
insurance claim? Congress should follow the example of these two states and forbid tlie use of 
credit data for insurance purposes. 

E. Broaden federal enforcement of the FCRA. 

1 . Appropriate federal agencies should conduct regular credit bureau FCRA compliance audits . 
An appropriate federal agency, such as the Federal Trade Commission, should audit the 
repositories’ records on a regular basis to identify data furnishers who report incomplete or 
incorrect information to the repositories. Such activity should be subject to fines or other 
penalties for non-compliance. These audits should also assess the overall accuracy of data 
maintained by the credit repositories, with appropriate fines or other penalties for inaccuracy. 

2. The Federal Trade Commission should collect, analyze and disclose information about credit 
reporting disputes . Credit bureaus should disclose to the FTC on a quarterly basis data about all 
disputes filed by consumers, the identity of the furnisher who provided the information in 
dispute, the outcome of the reinvestigation and the amount of time that the reinvestigation took. 
The FTC should be required to present an annual report to the Congress that aggregates this data. 
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analyzes the causes and outcomes of consumer disputes and offers public policy remedies to 
solve endemic problems. 

F. Legally empower consumers to combat credit reporting inaccuracies and abuses. 

Although federal and state authorities should do more to enforce the requirements of the FCRA, 
a handful of agencies will never be able to adequately keep track of problems involving more 
than 1 90 million credit reporting files. The combined restrictions on private enforcement of the 
act make it extremely difficult for consumers to hold credit fiirnishers and bureaus accountable 
for major violations of the law. 

1 . Make it easier for consumers to pursue a claim against creditors who report wrong 
information . Consumers can only enforce the already weak accuracy standard for data furnishers 
(mentioned above) under very narrow circumstances involving the reinvestigation of a credit 
reporting problem. As a result, virtually no private actions against creditors have been 
successful, even for grievous reporting errors. 

2. Increase legal deten'ents to egregious violations of the law. Several courts have held that the 
FCRA does not allow injunctive relief for consumers. Broadening this right will allow courts to 
prevent bureaus from issuing credit reports with false or disputed information. The law should 
also grant successful plaintiffs minimum statutory damages for egregious violations of FCRA, 
such as the failure to correct inaccurate information after notice is provided. This will provide a 
further deteirent to consistently sloppy and inaccurate reporting. And finally, because of a recent 
Supreme Court decision^^, it is necessary to reinstate the previous rule that consumers have two 
years from the date of discovery of an error (as opposed to the date the error occurred) to file 
suit. 

G. Improve baseline federal credit reporting standards. Allow states to exceed these 
minimum standards, as long as state law does not conflict with federal law. 

1 . Improve federal law . As identified above, the FCRA needs to be modernized and improved 
to insure greater accuracy of information and to prevent misuse and abuse of credit reporting and 
scoring information. This will benefit creditors, credit bureaus, and consumers. 

2. Allow federal preemption of state credit reporting laws to expire . The eight specific areas of 
federal preemption that were put in place for the first time in 1 996^’ expire on January 1 , 2004. 

If federal credit reporting consumer protections are broadened and improved, very few, if any, 
states are likely to attempt to exceed these baseline standards. However, the expiration of these 
preemptions would allow some states the opportunity to quickly re.spond to the particular needs 
of their states’ residents. This is what Vermont did in 1991 , when residents of entire towns were 


“ Andrews v. TRW, lnc„ .S34 U.S. 19 (2001). 

Under 15 USC Section 1681t(b)(l), these preemptions affect; (I ) prescreening of consumer reports by credit 
reporting agencies; (2) timelines by which a consumer reporting agency must respond to consumer disputes; (3) the 
duties of users of credit information that make adverse decisions; (4) the duties of a person using a consumer report 
in connection with a credit or insurance transaction not initiated by the consumer; (5) the type of information in a 
consumer report; (6) the responsibilities of furnisher of inform^ion to credit reporting agencies; (7) sharing of 
credit reporting information among corporate affiliates; (8) the form and content or disclosures that must be offered 
to consumers. Some stronger state laws were allowed to continue to exist under these provisions. 
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victimized by the systemic misreporting of false credit reporting information. It is always a good 
idea to require meaningful consumer protections in the least economically burdensome manner 
possible. However, to date, we have not heard a factual basis for the rather hysterical contention 
that the expiration of these preemptions will result in the passage of many burdensome state laws 
that will drive costs to consumers up, make credit unavailable to borrowers in some states and 
result in a “balkanization” of the credit system. In fact, testimony put on the record by the 
Assistant Attorney General of the State of Vermont and the U.S. Public Interest Research Group 
in a previous hearing documented that fair credit reporting standards have always been 
developed and enforced at both the national and the state level. As cited in these testimonies, 
there are a number of state laws that exist right now that either: (a) already exceed federal 
standards on preempted laws because they were “grandfathered” in as part of the 1996 FCRA 
amendments, or (b) exceed federal standards on non-preempted credit reporting laws. Proponents 
of continued preemption have not offered evidence that any of these laws, such as the California 
law tliat holds credit furnishers to a higher standard of accuracy than federal law, have led in any 
way to reduced credit e.xtension or higher costs for credit for consumers in these states. On the 
other hand, these laws have led to increased protections for consumers in those states, which is 
very positive. Continuation and expansion of a rational federal/state system of credit reporting 
standards is the best way to both provide some predictable baseline requirements for creditors 
and credit bureaus, while providing the best and most responsive protections for consumers. 

Thank you again for the opportunity to offer our views and recommendations. We look 
forward to working with you, Mr. Chairman, and the members of this committee to improve the 
Fair Credit Reporting Act for consumers. 
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Chairman Shelby, Senator Sarbanes and members of the Committee, thank you for this 
opportunity to appear before the Committee on Banking, Housing and Urban Affairs. For the 
record, I am Stuart Pratt, president and CEO for the Consumer Data Industry Association. 

CDIA, as we are commonly known, is an international trade association representing 
approximately 500 consumer information companies that are the nation’s leading institutions in 
credit and mortgage reporting services, fraud prevention and risk management technologies, 
tenant and employment screening services, check fraud prevention and verification products, and 
collection services. 

We commend you for holding this hearing on accuracy and the credit reporting system. As our 
members often state in testimony, accurate reporting is how they compete in the marketplace. 
The accuracy of reports is elementary to the success our country has had in evolving the most 
robust credit economy in the world; one that extends to more consumers today than ever before. 
In fact, the credit reporting system and. in particular, the national uniform standards created in 
1996 ensure that consumers enjoy $30 billion in additional disposable income per year due to 
increased competition. ’ 

When the Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.) was first enacted, the authors 
addressed the accuracy issue head on. The law requires that a consumer reporting agency 
maintain “. . .reasonable procedures to assure maximum possible accuracy of the information 

' Turner. Michael, et al., The Fair Credit Reporting Act: Access, Efficiency Opportunity, The Economic 
Importance of Fair Credit Reauthorization; Information Policy Institute, July 2003, page 5. 
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concerning the individual about whom the report relates.”^ In 1 996, the Congress took the step 
of enacting an entirely new provision of law that imposed a standard of accuracy on those who 
furnish information. ’ The FCRA's original authors had the foresight to create a law that also 
anticipated that an error could occur in a system of any size or scale. Thus, they created a series 
of duties for consumer reporting agencies, and users of consumer reports, to ensure that 
consumers are notified when a report is used to make a decision adverse to their interests, and 
they also ensured that consumers enjoy an unfettered right of access to their file. Perhaps most 
importantly, they ensured that consumers can dispute the completeness or accuracy of any item 
of information on their file. 


Accuracy - Putting the term into context. 

We all know what we mean by the term “accuracy.” But when we apply this term to an industry 
that sells two billion consumer reports per year and, in fact, which loads two billion updates of 
information per month, there’s some context that can help us in our discussion. Consider the 
following points about the term “accuracy.” 


Accuracy and Voluntary Reporting: Fundamental to understanding the flow of information to 
consumer reporting agencies from more than 30,000 data furnishers is the feet that these data are 
provided voluntarily. Thus, there is always a careful balance that has to be maintained in order 
to ensure that the law creates appropriate duties for ensuring accuracy and, alternatively, does not 
create a legal regime that imposes a strong disincentive to report at all. 

Accuracy. Consumer Reporting Agencies and the Law: The CDIA’s members are governed 
under the Fair Credit Reporting Act (15 U.S.C. Sec. 1681, et seq.), which establishes a duty that 
any consumer reporting agency must employ reasonable procedures to ensure the maximum 
possible accuracy of the information contained in the consumer report produced on a given 
consiuner at a given point in time. Simply put, the law requires that the information contained in 
the report must be accurate as of the date reported. The Federal Trade Commission’s own 
commentary on the FCRA provides the following comntent: 


- 15 U.S.C. Sec. 16Sle(b) 
’ PL 104-208 
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“General: The section does not require error free consumer reports. If a consumer 
reporting agency accurately transcribes, stores and communicates consumer information 
received from a source that it reasonably believes to be reputable and which is credible 
on its face, the agency does not violate this section simply by reporting an item of 
information that turns out to be inaccurate. However, when a consumer reporting 
agency learns or .should reasonably be aware of errors in its reports that may indicate 
.systematic problems (by virtue of information from consumers, report users, from 
periodic review of its reporting .system, or otherwise) it can review its procedures for 
assuring accuracy. " 

Accuracy, Data Furnishers and the Law: In 1 996, the FCRA was materially amended. Perhaps 
the most significant change was the addition of Section 623, which imposed for the first time an 
express duty on data furnishers to report accurate data to the consumer reporting agencies. In 
taking this step, the Congress acknowledged that consumer reporting agencies, on their own, 
could not fully ensure the accuracy of information absent the partnership with the data furnishers 
that voluntarily provide information to the databases of consumer reporting agencies. 

Accuracy and the Absence of Information in All Files: Some have posited that consumer reports 
are inaccurate when there is data missing from the file. CDIA disagrees with this 
characterization. There is no doubt that almost a perfect majority of the nation’s largest lenders 
report voluntarily to all of the nationwide consumer reporting agencies which produce what are 
commonly called “credit reports”. However, there are some smaller data furnishers which may 
choose to report only to one system. Some variance in product will always be evident in a 
competitive marketplace. While there are modest variances between nationwide consumer 
reporting agencies’ databases, they all compete based on file quality and content and, thus, all are 
constantly seeking to ensure that their reports are complete and fully representative of the 
consumer about whom the report relates. 

Note that credit repair can have a deleterious effect on the completeness of a consumer’s credit 
report and, thus, where third-party file comparisons identify absences of data betw'een files, this 
is in part attributable to credit repair. One of our members te.stified that more than 30 percent of 
all consumer disputes were generated by credit repair agencies, which commonly dispute 
accurate, derogatory' information with the sole intention of having that information deleted from 
the file. In 1 996, the Congress recognized the seriousness of the credit repair problems and 
enacted the Credit Services Organizations Act (PL 90-321, 82 Stat.164). That law prohibits the 
following with regard to credit repair activities and there is a continued need for even greater 
enforcement resources in order to ensure the effectiveness of the Act: 

SEC. 404. PROHIBITED PRACTICES. (7) 

(a) In General. —No person may— 

(1) make any statement, or counsel or advise any consumer to make any 
statement, which is untrue or misleading (or which, upon the exercise of 
reasonable care, should be known by the credit repair organization, 
officer, employee, agent, or other person to be untrue or misleading) 
with respect to any consumer's credit worthiness, credit standing, or 
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credit capacity to— 

(A) any consumer reporting agency (as defined in section 603(f) of 

this Act); 

Accuracy and Data Furnishing/Data Reporting Timing Issues: Some have reviewed reports about 
the same consumer obtained from more than one nationwide consumer credit reporting system 
and have suggested that differences in the status of a particular account (e.g., 30- v. 60-days 
delinquent) is an inaccuracy. In fact, the data is commonly accurate as of the date reported. 

There are a number of reasons for differences in the status of the same account on different 
“credit reports” produced by different credit reporting systems. For example, if a lender’s data 
center is on the west coast and it ships tapes of accounts receivable information to each 
nationwide credit reporting system, then the tapes may arrive on different days. The result is one 
of the nationwide systems may receive and load its update of a particular account sooner than the 
others. Thus, the status of a particular account is shown as sixty days delinquent on one system 
as of June 1, and on another the same account may, until the update is loaded, display the same 
account as thirty days delinquent (pending the update to sixty days as of June 1). Another reason 
may be that a data furnisher produced an incorrect set of data for one of the three systems and, 
via the credit reporting system’s audit controls, this tape is sent back to the data furnisher for 
reprocessing and correction. Tapes are also, though infrequently, damaged in transit and have to 
be sent back to a data furnisher for reprocessing. 

Accuracy and the Consumer - Perceptions and Realities: In assisting us with our responses to 
the GAO inquiry, one of our members observed that items in a consumer's credit file may be 
accurate, but not in ,sync with the consumer's perspective. Consumers have a tendency to 
"dispute" such items that are not in sync with their perspective, even when the data is accurate. 
Below are a few examples'*: 

(1) Maiden name - A married woman obtains a copy of her file and sees that her married name is 
not on file. She calls to dispute this and the representative asks her if she has applied for any 
credit in her married name. She replies in the negative and offers that she and her husband are 
now starting to apply for joint credit accounts. She is advised that infonnation in her file is 
reported to us by the credit grantors with whom that she holds accounts. Since she does not have 
any credit accounts in her married name, we would have no way of knowing that she has 
changed her name unless she reported this directly to us. 

(2) A consumer sees an old, dormant account on his file and indicates that he had long ago 
instructed the credit grantor to close the account. He might have confused that request with a 
similar request to another credit grantor. Or maybe he might have instructed the credit grantor to 
close the account and they never did. The point is that the information on file is accurate, 
because it is still an open account. 

(3) A consumer sees an account with General Electric Consumer Credit (GECC) on his file and 
indicates that he never did business with GECC before. However, the account in question was 


' These examples are drawn from the industry experts who lead consumer relations/assistance units for the nation’s 
largest consumer reporting agencies which maintain files on the majority of credit-active consumers. 
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with a retailer who subsequently outsourced their lending to GECC and the consumer never 
knew' of that relationship or isn't aware that some retailers outsource their lending. In this case, 
the consumer wall be adamant that the account is incorrect, but, in fact, it is accurate. Once they 
are made aware of the retailer's name (i.e. Home Depot for example), they acknowledge they do 
have a Home Depot account. The file w'as accurate. 

(4) A consumer sees a previous address listed as the current address and vice versa. He cannot 
understand how the credit bureau could make that mistake. However, the consumer had failed to 
notify some of his credit grantors about the previous move, so some credit grantors are still 
reporting the old address as current. This hasn't been an issue for the consumer because the mail 
from those credit grantors is getting forw'arded or the account is so inactive the credit grantors do 
not need to send them a billing statement very often. 

(5) A consumer sees his or her name listed with an unrecognizable combination of personal 
initials they don't remember using. The consumer's inclination is to believe the credit bureau is 
responsible for tills. However, the fact is that our members’ systems are incapable of making up 
a name. That particular name has transmitted it to us by the credit grantor. Either the consumer 
previously used that name with a credit grantor in the past or the credit grantor transmitted the 
erroneous name. 

(6) Consumers also often find that employment data is not current on their file disclosures. This 
is due to the fact that many lenders do not report employment data any longer. Nonetheless, the 
FCRA requires that a consumer reporting agency disclose “all infonnation in the file at the time 
of the request” and this includes dated employment data. 

The previous examples have no bearing on the lender's risk decision. Yet, the consumer has 
questions about this data and regards these as "errors" by the credit reporting agency. 

Accuracy and Divorce: One very significant challenge for CDIA’s members is the problem 
lenders and consumer reporting agencies have with how credit obligations are handled 
incorrectly by divorce courts. A divorce decree does not supersede an original contract with a 
creditor and does not release a consumer from his or her legal responsibility on those accounts 
entered into jointly with the former spouse. 

A consumer will see an item on his or her report and call to dispute the accuracy of it because 
they feel the divorce court adjudicated it. Despite the explanation that the debt is still owed, the 
consumer will argue that his or her lawyer did not advise them at the time of her divorce that this 
would be the case. We explain to the consumer that it is ultimately his or her responsibility to 
contact creditors and seek a binding legal release of the debt obligations that have been incurred. 

Accuracy and Expectations of Immediacy: Another very significant challenge is the perception 
by consumers that their credit reports should and can be updated nearly instantaneously. For 
example, consumers may review their credit reports and while data is accurate as of the date 
reported, they believe that recent payments should already be reflected showing a lower 
outstanding balance. A majority of data in the nationwide credit reporting systems is updated on 
a thirty-day cycle and this timing correlates with the thirty-day billing cycles for many types of 
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contractually prescribed credit payments to creditors. CDIA believes that a great many disputes 
are being driven by a desire to update information, which is otherwise accurate. 

Accuracy and Misunderstandings About the Law: Often enough our members report that 
consumers believe that when an account is delinquent and subsequently paid, that any negative 
information about the missed payments will be expunged from the record. Similarly, consumers 
often believe that an item placed for colleetion should be expunged once paid. In fact the law 
recognized that it is important for creditors to know' when the account was paid and to also 
maintain a history of the timeliness of past payments for purposes of safety and soundness. 

Thus, the law permits adverse information to remain on the file, but for no more than seven 
years. 


We .strongly believe that the context we have just provided is essential even as we try to review 
“hard” data that quantifies the accuracy of the credit reporting system. Anecdotes can be based 
on problems that are real and in some cases are driven by perceptions or misconceptions about 
how the system does or should work and even how other laws work. Finally, before we move to 
a review of sets of data, we caution against making the term “accuracy” synonymous with 
“consequential.” Some inaccuracies are inconsequential to the consumer, such as a missing 
middle initial, and some inaccuracies may be very consequential, such as an account on a 
consumer’s file which isn’t his or hers. 


Accuracy - What data is available regarding reviews of files? 

CDlA’s members have, in working with the General Accounting Office and in preparation for 
our testimony, developed or identified constructive sets of data that help us try and understand 
accuracy both from the perspective of the consumer’s experience and also from the viewpoint of 
the marketplace, itself. 

Let me restate a key statistic that provides context for some of the data to follow'. CDIA’s 
members estimate that there are no less than two billion consumer credit reports sold annually in 
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this country. Keep in mind that as these reports are being used to make decisions, every 
consumer who is the recipient of an adverse action notice can order his or her file disclosure and 
then exercise all other rights under the law that apply, including the right to dispute and have 
information corrected. Today, our members are issuing 16 million disclosures to consumers or 
eight tenths 10.8%! of one percent of the two billion files sold . To better understand who these 
16 million consumers really are, the following chart shows us the breakdown of which 
consumers ordered their files for which reasons: 


Average percentage of all file disclosures 
provided due to adverse action. 

84% 

Average percentage of all file disclosures 
provided due to fraud claim. 

11.5% 

Average percentage of all file disclosures 
provided due to curiosity. 

5.25% 

Average percentage of file disclosures 
provided due to a consumer being unemployed 
and seeking employment. 

.4% 

Average percentage of file disclosures 
provided due to a consumer being on public 
assistance. 

.1% 


Think of it this way; 1 6 million consumers are reviewing their files each year. Equally 
important, two billion consumer reports are being evaluated by lenders, whose ultimate goal is to 
ensure that consumers can: 

• drive off the car lot with a new car. 

• can move into a new home. 

• can get the college loans for their children. 


enjoy the widest range of loan products likely offered in any country' in the world. 
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In fact today, consumers today are enjoying some of the best mortgage interest rates ever and 
they can be assured of continued access to an extraordinarily competitive mortgage-lending 
marketplace through the reauthorization of the uniform national standards under FCRA. A 
national consumer credit reporting system which serves as the information infrastructure for our 
secondary markets can, reduce the average consumers interest rate by two full percentage 
points."’ 


Consumers by the millions review their files every year. 

Logically we should try to better understand what a review of their file meant to these 16 million 
consumers^ who request their files each year. Preliminary findings estimate that less than fifty 
percent of consumers who receive their file, which contains a toll-free number with access to live 
personnel, ever contact our members again. In fact, consider the following subpopulations of 
consumers and the rates of contact to further illustrate this point. In these two subpopulations of 
consumers who received their files, the reason was not associated with an adverse action notice. 
Data Set I - Consumers Who Suspect Fraud 

CDIA members have been proactive in providing a range of fraud assistance services to 
consumers who suspect they have or may become a victim of fraud. These consumers 
order their files and are provided with toll free numbers by which to contact live 
personnel. In this set of data, you’ll find that the rate of contact relative to the number of 
files issued is quite low and we think this is significant since it is quite likely that a 
consumer who is worried about fraud is more likely to scrutinize a file with the cliched 
“fine tooth comb” and, hence, more likely to find data about which they need further 
clarification or which should be disputed. Annualize these data and you have 1 .2 million 
consumers reviewing their files with a right to dispute any information and any time. Out 
of this 1 .2 million about 1 20,000 take the time to call back on the toll-free lines. 


^ Kitchenman, Walter, U.S. Credit Reporting: Perceived Benefits Outweigh Privacy Concerns, The Tower Group, 
1998, pages 7-8. 

’’ Note that the number of con.sumers could be less than 16 million since some consumers may order more than one 
file in a year and the 1 6 million is a count of the aggregate number of disclosures issued by all of the nationwide 
consumer credit reporting systenrs. 
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Average number of disclosures due to fraud per 
month. 

100,000 

Average number of contacts per month from this 
same population.^ A contact cannot be equated with 
a dispute or follow up question concerning any 
number of issues. 

10,000 (10%) 


Data Set 2 ~ Consumers Who Reviewed Files Due to Notices About File Activity 

In this set of data, gathered over a twerity-four-month period, consumers received a 
notice that their files had one of two events occur in the previous twelve-month period: 
(1) a certain level inquiry activity; or (2) additional adverse information reported. Here 
the consumer was given a reason for ordering a file and after a review only 9000 
consumers out of the 1 80,000 ever called back with a question. 


Average number of files issued per year. 

180.000 

Average number of contacts relative to this 
population. A contact can be a dispute or 
follow up question concerning any number 
of issues. 

9,000 (5%) 


These two sets of data are directly responsive to the vaifous reports issued over the years by the 
U.S.Public Interest Research Group and others about the accuracy of credit reports. These 
reports studied small populations of files also using US Pirg employees as the “reviewers”. 
Some of these reports used as few as 50 consumers. Contrast this with the data showing 
hundreds of thousands of consumers order their files and between 90% and 95% appear to have 
had no problem with their files whatsoever. 


CDIA also took a look at how the marketplace responds to accuracy of files. This particular set 
of data is important because it is reflective of the two billion reports sold annually by the nation’s 
largest credit reporting systems. It is through this set of data that we can now begin to 
understand one potential “driver” for consumers who review their files and do have a dispute. 
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That is the desire to update accurate information as of the date reported, but which the consumer 
wishes could be even more current due, perhaps, to a very recent payment made to a particular 
lender. As discussed earlier in our testimony, the consumers desire to have information updated 
immediately is real, though an update of accurate information is not a reflection of inaccuracies 
in the files of consumers. Rather it is a reflection of the needs, in particular, of the mortgage 
lending community. 

Data Set 3 - Review of Mortgage Reports 


CDIA worked with membem to develop a sample set of data that is derived from the 
marketplace and not based solely on a consumer’s review of the file, as is the case with 
the first two data sets above. We picked the mortgage lending process since this is a 
lending decision which still involves a good deal of contact between the consumer, the 
lending institution or mortgage broker, and the specialized CDIA members which 
produce mortgage reports. 

Mortgage reports most commonly include data from all three of the nationwide credit 
reporting systems. CDIA’s mortgage reporting members provide a range of services to 
mortgage lenders, including re-verifying information tliat may be accurate as of the date 
reported but which needs to be updated to a more current status, or adding additional 
information that was not present in any of the three reports ordered from the nationwide 
credit reporting systems. Clearly CDIA's reseller members provide valuable services for 
the mortgage lending community and for consumers. 

These data were gathered over a two-week period and, while some files were updated by 
the mortgage reporting services to a more current status, via direct contact with the 
providers of information, only one percent ( 1 %) of the files have an error. Further, it is 
not clear from this review that the one percent of files that did contain an error, contained 
one that was consequential to the lending decision. 


Size of Sample 

189 Three-File Merged Reports Reviewed^ 

Number of reports that were accurate based on 
direct contact with the original provider of the 
information, but which needed an update of 

61 (32%)'' 


Note that rate of dispute was not tracked but the rate of contact was. Thus, 100,000 consumers reviewed their flies 
and only ten percent ever decided to even make an additional phone call. 

* Note that 189 three-file merged reports equates to 567 individual reports from the three nationwide consumer 
credit reporting systems. 

Several of our members indicated that updates of accurate information may include the need to show a new 
balance due to a recent payment made by the consumer, or adding data which is missing from the file according to 
the consumer. 
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some information due to the need to show a 
new account status, or where additional 
information was added to the file wiiich was 
not present in any of the three reports produced 
by the nationwide credit reporting systems. 


Number of reports with an identified 
inaccuracy based on direct contact with the 
original provider of the information in the 
report. 

2 (1%) 


Accuracy - Can we learn more from the nature of disputes, themselves? 

Now let’s step back to the larger population of consumers who order and review their files to try 
to understand the reasons for which they may contact a consumer reporting agency and also the 
nature of the disputes they submit. At the macro level, out of 16 million file disclosures^^ issued 
to consumers eveiy year, preliminary data indicates that likely just over 8 million consumers 
review their files and, though they have access to toll-free numbers and live personnel, they do 
not call back at all . 


For those who do call back, many call in with questions and not necessarily disputes. Some of 
our members estimate that in a given month, what might be described as educational calls where 
a dispute has not been submitted can comprise as much as fifty percent (50%) of all contacts in 
any given month. As described above in our testimony, consumers’ perceptions about how a 
divorce decree should work or when a payment should be reported to the consumer reporting 
agency can drive phone calls that ultimately don't end up in a dispute of any sort being 
submitted. 


Out of the two billion consumer reports sold each year, eight tenths of one percent (.8%) ever order their file. 
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When it comes to the term “dispute” we believe we need to frame up some guiding thoughts on 
the difference between a dispute about a true inaccuracy and a dispute which is really associated 
with updating a file which has accurate information as of the date reported. The acknowledged 
difficulty of measuring “accuracy” via dispute rates is illustrated by the many reasons we’ve 
already discussed for which consumers may request changes in their files where the information 
was, in fact, accurate as of the date reported, or where they don’t recall having opened an 
account, or where they misunderstand the law. Below for the sake of brevity are just some of the 
examples of disputes of accurate information as previously discussed: 


o An item that is accurate as of the date reported and the consumer is actually 
seeking to update information between the regular reporting cycle of thirty days 
o An item that is disputed as a result of credit repair activity wherein the credit 
repair agency might be disputing all accurate but negative information in the file 
with the goal of having some or all of the infoimation deleted, 
o An account that a consumer doesn’t recognize because it has been inactive for an 
extended period of years, or because the name of the owner of the account is 
different than the retailer with whom the consumer did business, 
o An item which is accurate, but which conflicts with a divorce decree, wrongly 
abrogating a consumer’s obligation to pay. 

Data Set 4 - Industry-Wide Disclosures to Consumers and Dispute Responses to 
Disputes Submitted 

The following are industr>'-wide data from CDlA’s nationwide consumer credit 
reporting system members. CDIA believes several points are necessary to put the 
following data in a reasonable context: 

1 . A dispute does not equate to an acknowledgement of inaccuracy as previously 
stated. 

2. The percentage indicated below cannot be used to infer an estimated rate of 
inaccuracies in files since many disputes are not related to inaccuracy per se, but 
rather to a desire to “update” information outside of the regular cycle of thirty 
days used by most data furnishers. 

3. The data below be used to determine the consequence of a particular dispute 
relative to the consumer’s estimated risk. A valid dispute about an item of 
information such as a consumer’s middle initial will result in a change to the 
consumer’s file, but won’t have any bearing on credit risk. 
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Type of Result Based on Dispute 
Submitted" 

Percentage 

Infonnation verified as reported. 

46% 

Data modified per data furnishers 
instructions. Note that data may have 
been modified due to an update of 
information rather tlian a dispute about 
the accuracy of the data as of the date 
reported. 

27% 

Data deleted per data furnisher’s 
direction. 

10.5% 

Data deleted due to expiration of the 
thirty-day period and no response 
received from the data furnisher. It 
cannot be determined w'hether the data 
was accurate as of the date reported or 
not. 

16% 


To provide context for the results of the disputes in the chart above, and to lay out a better 
understanding of the nature of disputes and to identify which disputes are most common we 
gathered the following data. Consistent with our discussion above and particularly our points 
about expectations for immediacy, confusion with regard to divorce and those focused on various 
consumer perceptions, it is not useful to consider all disputes as being associated with an 
inaccuracy. Following arc the top disputes that our members receive and which reflect the 
preponderance of all disputes submitted. This listing is not in perfect rank order since there are 
variances in the dispute patterns between companies: 


Dispute 

Estimated Rank 

“Not his or her account.” 

1 

“‘Disputes any of the following items: Present or previous 

2/3 


' Our members consistently estimate that the number of disputes submitted by credit repair agencies/clinics is as 
high as one-third of all disputes submitted. Credit repair agencies, according to the FTC, are notorious for 
submitting false claims of inaccuracies with the sole intention of deleting accurate information off of credit files. 

Note that this percentage does not relate to the total number of file disclosures issued. A majority of file 
disclosures do not result in any type of dispute. 
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account status or payment history or payment rating. 


“Disputes the current balance. 

3 

“Claims account has been closed” 

3 

“Disputes related to disposition of accounts included in or 
excluded from bankruptcy or the bankruptcy of another 
person.” 

4 


It is difficult to draw full conclusions from the data above since only eight-tenths of one percent 
(0.8%) of all consumer reports sold result in consumers ordering a file disclosure. Preliminary 
data indicates that of those who do order a file, fully four-tenths of one percent (0.4%) of all files 
sold result in consumers deciding that no further contact was needed . We have presented other 
data that shows that where consumers are likely order files for a reason other than adverse action, 
(see Data Sets 1 and 2) the contact rate is very’ low with a range of ninety percent (90%) to ninety 
five percent (95%) not choosing to contact the consumer reporting agency after reviewing the 
file. Based on these data sets, it is possible to surmise that perhaps consumers who order files 
due to an adverse action have a higher likelihood of calling, at least to ask a question, which 
explains why the aggregate rate of contact for all file disclosures is higher. These 8 million 
consumers also equate to four-tenths of one percent of all files sold (0.4%). You can see by the 
results of these consumers, who may be submitting disputes, that fully 46% of the disputes come 
back with the information verified as reported (see Data Set 4). The marketplace data we 
presented in Data Set 3, where 567 files used for lending decisions were reviewed, one percent of 
the files contained an inaccuracy. 




Accuracy and industry standards. 


CDIA’s members constantly seek better ways to achieve higher rates of accuracy. The following 
discussions of the CDIA’s data standards project and operation of an automated consumer 
dispute verification system called E-OSCAR-web™ is provided below. Both of these projects 
are specific to the operations of nationwide credit reporting systems. Each Association project 
makes a contribution to accuracy of information. 

METRO FORMAT 


More than 30,000 data furnishers provide approximately two billion updates of information per 
month to the nationwide credit reporting systems. No law requires any furnisher of information 
to provide data to a consumer reporting agency. 

A data format standard becomes a very important part of how the industry can ensure greater 
precision in the reporting of information, particularly with such a wide diversity of data 
furnishers' ^. If each of these data furnishers can choose how to report data and what data goes 
into what fields or how to define the status of accounts, then the files of any given consumer are 
likely to reflect a wide variety of approaches to reporting information making it far more difficult 
to properly and fairly assess a consumer’s risk. 

The original Metro format for credit reporting was first developed in the mid 1970s. Over the 
years, it has gained in popularity and achieved a high level of use in the marketplace. By 1996, 

Examples of data ftirnishers include credit unions, savings and loans, thrifts, mortgage lenders, credit card issuers, 
collection agencies, retail installment lenders, auto/finance lenders and more. 
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more than 95% of all data was received by the nationwide credit reporting systems in this 
Format. 

In 1996, the credit reporting industry took advantage of the opportunity afforded by the Year 
2000 data processing “bug” to completely reengineer the format for credit reporting. The Metro 
2 Format was introduced in 1997 and has been steadily gaining in use by the data furnisher 
community. At this time, more than half of all accounts are reported in this new Format. 

Both the original and the new Metro 2 formats are maintained by an industry committee of 
volunteers from each of the national credit reporting systems. This group meets on a regular 
basis to develop industry-wide responses to questions from data furnishers and create new codes 
or fields as necessary . From time to time, this group will also create and deliver training sessions 
on the Metro 2 Format for data furnishers that have not yet converted to the new format Several 
training sessions are scheduled for 2003. 

Typically, data furnishers report data on a regular basis, usually monthly. The industry does 
encourage those companies that bill their customers in cycles (e.g., every 30 days) to report that 
data to the consumer reporting agencies in cycles, thus ensuring that the data is not only accurate 
as of the date reported but is also as current as possible. 

The Metro 2 Format documentation is distributed within the industry by the Association. Data 
furnishers can obtain the document in hard copy or can dovmload it from the CDIA website. For 
2003, almost 1,000 copies of the Format have been distributed. 
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The documentation is quite extensive and granular. For example, for the FCRA 
Compliance/Date of First Delinquency field, a full page is devoted to a description of each 
particular circumstance under which this date should be reported. A full definition of the field is 
provided. Procedures for reporting the field if the account should become current are discussed. 
In addition, the industry developed three detailed examples show'ing exactly how to calculate this 
important date in different situations. We have also provided the exact language of the Fair 
Credit Reporting Act detailing this requirement for the convenience of customers. This specific 
example is attached for your review. 

The industry also receives and publishes a number of Frequently Asked Questions with Answers. 
For example, we have been asked questions as precise as “How should the original loan amount, 
current balance and monthly payments be reported for end-of-lease charges (excess mileage, 
wear and tear)?” This question, about auto leasing, was received during one of our face-to-face 
workshops. The industry response provided a great deal of information for the data furnisher. 

“There are various Special Comment Codes that can be reported for Leases. See Exhibit 
6 (Special Comment Codes by Category Within Portfolio - pages 5-12 through 5-13). 

For example, if the lease is a full termination with a balance owing. Special Comment 
"BD" should be reported. If the lease is an early termination with a balance owing, 
Special Comment "BG" should be reported. 

The Original Loan Amount (Field 12) should not be changed. Current Balance (Field 21) 
should contain the end-of-lease charges for excess mileage and wear and tear. If there is 
an amount past due, it can be reported in Amount Past Due (Field 22). Scheduled 
Monthly Payment Amotmt (Field 15) should contain the dollar amount owed each month 
if a schedule of payments is arranged. Otherwise, Field 15 should be zero-filled. Actual 
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Payment Amount (Field 1 6) should contain the dollar amount of the monthly payment 
actually received for the reporting period.” 

E-OSCAR-weh™ 

The consumer reporting industry, through the auspices of the industry Association, came 
together in 1992 to build an Automated Consumer Dispute Verification (ACDV) process. This 
voluntary industry effort predated the FCRA amendments by a full five years. The network went 
live in November of 1993 and began growing quickly thereafter. Fully 50% of all consumer 
disputes sent by the consumer reporting industry to data furnishers were traveling through the 
ACDV process by 1996. From 1996 through 1998, the industry remained at that 50% market 
penetration. In 1998, we began a reengineering process to help capture additional users. We 
also took the opportunity to match up the ACDV process with the new Metro 2 Format. In 2001, 
we began beta testing the E-OSCAR-web'’'” network with data furnishers. We successfully went 
live in the early summer of 2001 and have retired our old network. The new network is secure, 
encrypted, and available to a larger number of companies because it is browser based. The 
industry has ambitious plans to encourage all of the data furnishers to migrate to the E-OSCAR 
network. 

The essential process has remained the same since created in 1 992, though recent technology 
innovations should encourage broader use of the system by smaller data furnishers. The 
consumer reporting agency receiving the dispute sends that dispute to the data furnisher. 
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The data furnisher researches the dispute, provides an answer and, if changing the account or 
deleting it, provides a copy of the dispute and the response to each of the consumer reporting 
agencies to which it reported the data originally. 



TransUnion 
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Conclusions 

There are some conclusions or themes that are essential to putting the “accuracy” discussion in 
context: 

• Consumer education will cause greater activity by individuals relative to their credit files. 
Consumers are learning more about their credit files and about how their credit reports 
can positively affect their lives. We believe that many consumers who “dispute” an item 
of information on their files are actually seeking to “update” data in tlieir files, which is 
accurate as of the date reported. However, they would like to have a more current status 
reflected (something less than the usual cycle of 30 days for updating data which is the 
data furnisher norm.) 

• More than two billion consumer reports are sold annually. When you put file disclosure 
rates into the context of tlie number of files sold, they tell a very valid and good stoiy 
about the industry’s performance. 16 million consumers receive file disclosures, 
representing eight tenths of one percent (0.8%) of consumer reports sold. Only about half 
of those consumers ever contact (not necessarily to dispute an item) the consumer 
reporting agency and this represents a population which is four tenths of one percent 
(0,4%) of the total files sold in the marketplace. Of the consumers who do contact our 
members in any given month, our members say that half may have questions but no 
particular dispute. Of consumers who do dispute information (which can vary per 
month), 46% of the disputes are reverified accurate as reported by the lender which 
reported the information. 
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• Even where disputes are made, not all disputes are equal. Some are consequential and 
some are not related to risk assessment at all. 

• Consumers are a good, but not perfect measure of the accuracy of their own files. CDIA 
has provided a range of examples of where consumers themselves may be confused about 
what should or shouldn’t be on their files. Divorce, confusion over old accounts or w'ho 
closed an account are just some of tlie many catalysts for confusion. Confusion about 
what is or should be in a file is often defined incorrectly as the presence of inaccuracies. 

• A small sample of reports actually used in the mortgage lending context showed that only 
one percent (1%) had a confirmed inaccuracy. This information is important because it 
helps show that you cannot measure accuracy purely via di.spute rates. 

In conclusion, the CDIA’s members remain committed to the accuracy of every consumer’s file. 
CDIA’s members cannot achieve this on their own and they are dependent in part on the quality 
of information furnished to them. Our members offer industry standards by which data can be 
reported and also a veiy sophisticated network for quickly and efficiently processing that data. 
We could do an even better job if eveiyone used our newest data standard and also if every one 
of the 30,000 furnishers of information would also use the online system for processing 
consumer disputes. Our members can only work collaboratively to the extent law permits. 
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reSTlIVIONYOFRICHAR0 F. LE FEBVRE 

On Behalf of AAA American Credit Bureau Inc. 

Before the 

Committee on Banking, Housing, and Urban Affairs 
United States Senate 
July 10, 2003 

Good morning, Chairman Shelby, Ranking Member Sarbanes and distinguished members of the 
Committee on Banking, Housing, and Urban Affairs. My name is Richard Le Febvre, and I am President of 
AAA American Credit Bureau, Inc. (AAA). My company is a credit-reporting agency (“CRA/reseller”) 
based in Flagstaff, Arizona. I have worked in the credit reporting industry tor over 12 years. My agency was 
one of the first in the country to provide “rescoring” services to consumers. I started doing so in 1998. My 
work in rescoring and assisting consumers to correct errors in their credit reports has drawn national 
attention, including for example a column in the July 14, 2001 Washington Post attached as Exhibit A hereto. 

Credit scores are used in a wide variety of consumer transactions. Credit scores are calculated by 
applying various proprietary “credit risk models” to information contained in credit files. The credit repoi*ts 
most widely used are sold by TransUnion, Experian, and Equifax. Unfortunately, credit reports often contain 
inaccurate and/or outdated information about consumers. Inaccurate infomiation can and often does 
significantly affect credit scores. See, e.g., Ken Harney, “Credit Report Errors Can Prove Costly,” 
Washington Post (June 14, 2003), attached as Exhibit B hereto; and credit scores help determine eveiy day 
whether consumers will be extended credit and, if so, the credit terms and conditions. 

These industry developments make the requirements of the Fair Credit Reporting Act (FCRA) more 
relevant and crucial than ever. In particular, consumer reporting agencies and resellers of consumer reports 
must “follow reasonable procedures to assure maximum possible accuracy” of their credit information. The 
lightening speed and efficiency of automated credit decisions does not assure accuracy of the underlying 
data. Automated underwriting depends on accurate information about the particular applicant. The old 
saying “garbage in, garbage out” holds true. Worse yet, the dazzling efficiency of automated systems may 
be providing false comfort that automated credit decisions necessaiily reflect true ciedit risks. 

Studies have shown that credit reports may contain large numbers of errors. 1 have attached a two- 
year study that we did for the years 1999 and 2000 ^ attached as Exhibit ‘C” hereto, which shows that our 
study and the CFA/NCRA study correlate. A copy of our AAA Credit Score was used to generate the results 
of our study attached as Exhibit “D” hereto. Scores are based on groups, but what if the consumer is placed 
into the wrong group based on errors within their credit file? The CFA/NCRA study “ concluded that, out of 


AAA Study showing cn'or rates from 1 999 - 2000 (Exhibit C) 

httir://www.ncrainc.org/documents/CFA%20NCRA%20Credit%20Score%20ReDort-ndf December 17, 2002 CFA/]\'CRA study 
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500,000 C/R’s in their study, 1 in 3 consumer had point variations of 50+ points, 1 in 20 had 100+ point 
variations, but the average point variation was 43 per C/R. 

My point is that increasing efficiencies in processing applications and increasing sophistication in 
credit underwriting rules should not be mistaken for assuring maximum possible accuracy of the consumer 
information used. Indeed, automated systems “must not” be allowed to interfere with the requirements of the 
FCRA or the opportunity for consumers to dispute information in tlieir credit reports. Reasonable procedures 
for assuring maximum possible accuracy often requires a human being to make calls, interview the 
consumer, verify consumer’s documentation, and apply professional judgment. Unfortunately, some 
underwriting systems make it impossible or too expensive for consumers, consumer reporting agencies, and 
resellers to do their jobs ’ in direct violation of the FCRA, consumers rights, and CRA/reseller requirements. 
MY EXPERIENCE WITH CREDIT REPORTS 

I’ve reviewed tens of thousands of “merged” reports that have information from more than one 
national credit bureau, but usual ly they contain all three regarding the same consumer and/or joint consumer. 
In merged reports, information from the same creditor is grouped together as reported by each repository. 
This is done for both the applicant and co-applicant. In my experience, the information about a consumer’s 
account with a creditor often differs significantly, depending on which national credit bureau is reporting the 
information. The information regarding the same consumer and the same creditor is often inconsistent. As a 
result, a consumer commonly—almost always — receives different credit scores from each repository, and the 
differences are often significant. The differences can sometimes be “explained” vaguely by the use of 
different credit risk models (which are proprietary and not available to consumers) and different dates for the 
creditors’ updates, but in my experience the difference can often be explained by inconsistent information 
about the consumer. 

It astonishes me to this day how the same credit information furnisher can report different 
information about the same account, but it is a common problem. Perhaps this is a “Tower of Babel” 
problem. Credit furnishers use many different types of processing software, and they are communicating to 
the three repositories, which each has different software and formats for receiving the data. 

Solution 

Allow all CRA/fesellers to perform to the standards set out by the FCRA and the FTC’s consent 
order with Credco, which spells out responsibilities of “all” resellers attached as Exhibit “E” hereto. The 
user and/or person that makes, participates in, or arranges extensions of credit “must” accept the verified 
accurate report that meets the requirements under the FCRA. Plus require all credit data providers to update 
to the Metro II format by a specific date. 


^ For purposes of the Fair Credit Reporting Act (“FCRA”), foe term “credit reporting agency” includes any 
business that compiles information about consumers and provides “consumer reports” to third parties. Please 
keep in mind that “any” person that regularly engages in, participates in whole or in part in the practice of 
assembling or evaluating consumer credit information or ofoer information on consumers for the purpose of 
furnishing them to third parties is considered a “(Xinsumer reporting agency”. 
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SCORING/RESCX>RlNG 

AAA has perfomied re-scoring. Re-scoring often involves the following; 

> Updating of credit information 

> Updating account balances 

> Deleting/updating inaccurate ti'adeiines 

> Deleting obsolete tradelines 

> Updating/deleting public record data 

> Deleting inaccurate late payments 

> Updating incomplete and/br missing data 

In many cases, reports can vary, based on inquiry input and date based on many factors, but here are 
the three most common factors; First, wrong input by subscriber/user. Second, missing or incomplete data. 
Third, since data changes almost daily, the information one user sees on a credit report may differ greatly 
from what another user receives, based on the time the reports were pulled. As a result, scores vaiy 
depending on the different versions of the scoring models used by lenders and the GSE's. I have seen credit 
reports differ significantly, including credit scores from day to day. 

Assuring an accurate credit history, and credit score, is an ongoing and difficult process for 
consumers. It can become a full-time job for those who are victims of identity theft, fraud, inaccuracies, or a 
stubbornly lazy furnisher of credit information. I have attached some rescoring examples we have done that 
show how dependant a credit score is on accurate data and how some credit scores truly make no sense. 

Score ™ EXAMPLES (actual files) 

Exftmple#l - Based on one $10 missed payment (that was not late) had a 3-year history with no lates, 

Mr. & Mrs. Hispanic 
Mid Fico score -731 -6/7/99 

Mid Fico score - 587 - 7/9/99 (after one missed $10 payment) 

XPN - 72 points (average drops per bureau after one missed $10 payment) 

TU -121 points 
EFX - 178 points 

Exami<e#2 - had 2 1 collection/chargcd off acets that did not belong to him, but another with same name 
EFX - 520, XPN - 541 , TU - 506 

Example #3 - Based on errors by Macy's 1x30, 1x60, 1x90, 1x120, 1x150 
Retired Female 

EFX -611 - 11/09/00 (before re-scoring), TU - 617. XPK- 674 
EFX -743-11/1 5/00 (after re-scoring), TU - 744, XPN - 733 

Examine #4 

Consumer has 2 foreclosures with scores of 
726, 732, 735 

Co-borrower with no foreclosures 
655, 696, 680 

Example #5 

Consumer with multiple bankruptcies filed within the same 2 years and within the last 36 months and multiple Fed Tax 
Liens and many collections and charged off accounts, but have the following scores: 

EFX - 672, XPN - 642, TU - 636 

It just goes to show that everything is not what it appeal^! 
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Example#^ - Six months history, higher then avg scores, no track rec, consumer has 1 acet opened 1 2/99 

EFX - last reported 08/00 - months reviewed - 8 

XPN - last reported 05/00 - months reviewed - 6 

TU - last reported 07/00 - months reviewed - 24 

XPN - 700, TU - 687, EFX - 702 

Solution 

Require the same scoring model “versions” to be used as provided by the credit grantor, Fair Isaac, the three 
CRA’s, or any other third party vendor. Have credit scores valid for 90 days during the mtg process. 
CONSUMER DI^LOSURES CAN mFFERFROM ^RETAIL’’ CREDIT REPORTS 

When a consumer orders his or her own report, which is called a “consumer disclosure,” the 
consumer must produce many pieces of identifying data in order for the three national repositories to produce 
and send a consumer their disclosure. This means that the more identifying data put into the bureaus 
networks the more accurate the consumer disclosure. Users of credit information many times take a less 
accurate approach because users often have less complete data to identify the consumer. For example, 
users/lenders input partial names, only the current address, and sometimes plug in a number such as “000-00- 
0000” for the Social Security number. The “0” Social Security number may return a “hit” with the 
consumer’s accurate social security. Identity thieves also obtain consumers’ Social Security numbers this 
way. 

In addition, “retail” versions of credit reports generated to resellers, users, and paying consumers 
differ from the consumer disclosures that consumers receive for “free” following adverse action by a 
creditor. The FCRA requires that any consumer-reporting agency, upon request of a consumer, must 
disclose “everything” in the consumers report (excluding any type of credit score). Many consumer 
disclosures do not include date of first delinquency or do not include all “late dates” in the payment pattern 
and/or do not receive the 24-48 month payment grid. In short, consumers are not receiving everything 
contained in their credit files. 

Solution 

I would suggest that the FCRA be amended to expressly require that all credit furnishers report “full” 
and uniform account infonnation to the national repositories. Require retail versions of consumer credit 
reports instead of consumer disclosures. 

MFitGE BEENDING 

This is another major problem within the mortgage industry that lenders and the GSE’s except as an 
acceptable practice because they want/need these quick and dirty credit reports no matter the cost to the 
consumer. The top credit reporting agencies that are on many AIJ systems use “meige blending”. This is how 
it works; lets say ACB credit furnisher rejwrts to XPN as 1x30 (late was 1/03), TU as 1x30 (late was 2/03), 
and report to EFX as 1x30 (late was 3/03) its clear that the furnisher intended to only report 1x30. The tri- 
merge credit report would show^ that the consumer was 3x30 (lates in 1/03,02/03,03/03) while ha\dng an 
aftect on a credit score it has a larger affect on a consumers credit risk, credit worthiness, and credit 
reputation and many times creates loan denials based on felse information. 
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If the consumer disputes the inaccurate information tfiat was reported on the tri-merge credit report 
with Experian, TransUnion, and Equifax that they were “never” 3x30 ail three bureaus would only show it as 
1x30. It’s a circle of deceit that harms consumers, which could lead to a credit denial or higlier rates and fees 
and violates the foundation of the FCRA. 

Solution 

I would suggest that the FCRA be amended to expressly ban the practice and require that all 
CRA/resellers who have knowledge of errors from the same furnisher to verily the inaccuracy with the 
furnisher directly. 

CERTAIN CmmT DATA PROVIDERS HARM CONSUMERS 

The American Banker‘s did a story titled "'Hearing to shine spotlight on credit process” in which I 
provided an example of a consumers rescore we did showing how a young couple was harmed by Capital 
One’s refusal to report full account information. As this article points out, it is Capital One’s policy not to 
report full account infoimation such as a consumers credit limit and you have to ask yourself why? Do they 
know that not reporting the credit limit on revolving credit cards lowers a consumers credit score? This 
practice unfairly keeps consumers in higher rate credit cards and this in turn keeps the consumer from price 
shopping for better rates in a free and open market. One of the driving forces behind calculating a credit 
score is to determine a consumer’s likelihood of default, credit risk, credit worthiness, and credit reputation. 
One on the top reasons why a credit score is not higher, that appears on almost every consumers adverse 
reason summary, is #10 “proportion of balances to credit limits is too high on bank revolving or other 
revolving accounts”. I'his practice affects this reason code and others because it gives a “false” indication of 
the overall revolving indebtedness, which is a major factor driving a consumers credit scores. 

The younger the consumer the more negative impact on their credit scores or the thinner the file the 
more negative impact on the scores. This practice is not limited to Just Capital One because other credit card 
vendors are also involved in the practice, but others aren’t as large, and only do it periodically. Capital One 
being one of the largest credit card vendors if not the largest and Capital One does it on “all” cardholders, 
which affects more people. This means that almost every Capital One card holder is having their credit 
scores artificially lowered, which could make a major difference in getting declined or paying higher fees 
and costs. 

Solution 

Require through legislation and/or through agreements with all three repositories that all credit 
furnishers report “full” account information or they will not be able to pull credit reports under account 
review or upon a credit application. 1 know industry will state that our credit system is voluntary, which it is 
and many credit furnishers who report now would pull out reporting any data at all, but that is simply not 
going to be the case. 


American Banker ‘‘FCRA Rearing to Shine Spotlight on Credit Pra:ess” dated 06/1 2/03 
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H.R. 2622 

1 am not in favor of this bill for many reasons, but it does have some real good consumer protections 
built into it. First, the only thing that consumers gain from this bill is one “free” consumer disclosure per 
year, but they don’t gain a “free” credit score as a matter of fact they don’t even gain access to their credit 
scores at all. The only thing coisumer’s get/receive from this bill is a “summary of credit scores”, which 
truly does consumers no good. It’s like trying to bake a cake and having all the ingredients, but vdthout 
having the directions (the score). You will probably wind up with a mess in the oven. Consumers will wind 
up with more questions and problems then ever before. 

Second, CDIA has worked hard and lobbied hard to get all these reseller “exemptions” built into this 
bill, which doesn’t do the consumer any goc^ at all. Since CRA/resellers control most of the mortgage, 
employment screening, and tenant market dien this bill does consumers no good if they are victims of 
identity theft, fi^ud, or inaccurate credit reports if the consumer is involved in a purchase of a home, 
refinance, employment, or looking for a home or apartment to rent. 

Here is an example: Mr. Smith applies to buy a home and puts into escrow his whole life savings of 
1 OK as a nonrefundable deposit as required in most real estate transactions. Mr. Smith didn’t listen to all the 
propaganda out there in regards to checking his credit first. He knew he checked it about 6 months ago and it 
was great, but now he finds out he’s a victim of “Identity theft”, fraud, or inaccuracies because his loan 
officer mistakenly showed him his tri-merged credit report. This is where many times consumers find out 
that they are victims of identity theft, fraud, or inaccuracies. So he calls ABC reseller who prepared the error 
filled report and the CRA/reseller is prohibited from helping him because of H.R.2622. Even though they 
produced the inaccurate credit report for the lender. So the consumer is faced with only two opinions; first, 
walk away from the property and lose his deposit because most R/E contracts don’t allow refunds unless you 
have been turned down. Second, since he was never turned dowm he would have to take the sub-prime, A- 
loan, which changes the rate considerably, the terms, may require more down, and may have a prepayment 
penalty. This is a decision consumers should not have to face when they are buying a home, which will many 
times be their largest purchase, their life savings, and their future financial nest egg. There are other issues I 
have with this bill, but this is the main one. 

My position along with the rest of the CRA/reseller industry is we want the responsibility and we 
also want to be able to help all types of consumers who are victims of identity theft, fraud, or inaccurate 
credit reports if we have pennissible purpose as outlined in the FCRA. If this bill passes then only consumers 
will be harmed if they are victims of the largest growing crime in the world identity theft and fraud. These 
two crimes also harm the lenders who lose out in making a loan because we the CRA/resellers have our 
hands tied by this bill 
Solution 

No CRA/reseller exemptions, keep it “status quo” where all CRA/resellers have all the same responsibilities 
as the national credit repositories Experian, TransUnion, and Equifax. Require the end-user and/or 
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CRA/reseiler, during the mortgage process that uses or generates any type of credit scores for automated 
underwriting, be required to provide to the consumer a copy of “all” consumer reports, credit reports, and 
credit scores within 5 business days after such use and/or after adverse action is taken. 

PRIVACY 

As noted above, the 1 996 amendments to the FCRA sought to improve consumer report accuracy by 
placing a larger burden on credit furnishers to report information accurately. Many times furnishers utterly 
fail to meet their duties under the FCRA. Many times consumers dispute the information with both CRA’s 
and with furnisher directly. 

The sale to a collection agency by furnishers of inaccurate information about consumers is the kind 
of egregious invasions of privacy the FCRA was intended to prevent. These actions by furnishers in turn 
lead to additional, severe privacy invasions in the form of collection agencies calling and writing to 
consumers at work and at home. This type of invasion of privacy goes up tremendously when the consumer 
is a victim of identity theft where a number of furnishers and consumer reporting agencies believe that the 
victim is “guilty until they prove themselves innocent instead of innocent until proven guilty”. 

Again, a central purpose of the FCRA is to protect consumers by ensuring accuracy and giving 
individuals reasonable control over their personal information. It is time for furnishers to be accountable for 
its multiple invasions of consumers’ privacy. 

CREDIT FURNISHER UABIUTY^ I681s-2(b) 

Many times furnishers report the same status on an account to all three repositories. Then they verify 
that an account they reported to both TransUnion and Experian was “accurate”. On the other hand they 
reported and verified the same account to Equifax as “inaccurate” or any variation of bureaus listed above. 
On its face this violates the Fair Credit Reporting Act (“FCRA”). The reporting of “two” sets of data 
undeitnines our banking system, which is dependent upon fair and accurate reporting by furnishers. 
Inaccurate reporting by furnishers after a consumer exercises his/her rights under reinvestigation directly 
impairs the efficiency of the banking system, and unfair credit reporting methods undermine the public 
confidence, which is essential to the continued flmctioning of our banking system. 

The definition of inaccurate information in a consumers report means “any” misleading, incomplete, 
and/or outdated data, which tails to convey the full and true picture of a consumers credit reputation, credit 
risk, and credit worthiness. 

Sometimes as professionals who know the system, we have to allows the consumer to get off the 
merry-go-round and do whafs right instead of just quoting company policy and procedure. The burden of 
proof falls directly on the furnisher of the information. The FCRA requires reasonableness during the 
reporting of data and then puts a higher standard on all players after the consumer exercises their rights under 
reinvestigation. Many cases clearly cross over the line on the issue of reasonableness. Many times furnishers 
do the following; 

• Fail to properly notify all three repiositories that foe information was inaccurate; 
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• Report information again a fter notice and confirmation of errors; 

• Fail to follow reasonable procedures to prevent reinsertion of previously deleted data; 

• Fail to provide notice of dispute to all three repositories after the consumer disputes; 

• Fail to conduct an adequate investigation with respect to the disputed information; 

• Fail to review all relevant information provided by the consumer or repository; 

• Fail to report the results of their investigation to “al!” consumer reporting agencies; 

Solution 

Allow consumer to dispute directly with furnisher under 1681s-2(a) with the same furnisher liability 
as under 1681 s- 2 (b). 

REINVESTIGATION - 1681 i 

In the industry cf credit reporting all three national repositories have been over the years trying to 
convert all their customers/fumishers over from the old Metro format to the new and Improved Metro II 
foimat. Many of the customer/fumishers have been refusing to convert to the new Metro II. Since all three 
national repositories depend on their customer/fumishers for data in order to have a product to sell it’s kind 
of like having “the fox guarding the hen house”. 

The human factor during the credit reporting process cannot be under estimated. Throwing 
technology at a problem “credit reporting errors” does more harm, when sometimes only a human can protect 
consumers against inaccurate reporting no matter who’s at fault. In my experience of handling thousands of 
consumer disputes under the FCRA, sometimes only a piece of paper, pencil, and a telephone call can assure 
the maximum possible accuracy as required under the FCRA. The average consumer relation’s person at the 
repositories has to generate and complete 10 - 15 consumer disputes per hour. As a CRA/reseller, handling 
consumer disputes, our average time “per disputed tradeline” is 30-45 minutes some lasting much longer; the 
dispute quality coming from the repositories must be questioned at an average time of one consumer every 
five minutes per customer service representative. 

It is my opinion that the repositories do an overall fair/good job, but when the dispute is more 
sophisticated requiring more then basic thought then they fail their responsibilities under the FCRA for not 
following reasonable procedures based on the following reasons: 

• The repositories failed to properly notify credit furnishers within 5 days of dispute; 

• Repositories failed to include all relevant information regarding consumer to furnisher; 

• Repositories fail to understand clearly many consumers disputes during reinvestigation; 

• Fail to have reasonable procedures in place to assure maximum possible accuracy; 

• Fail to follow procedures stopping ftimishem reinsertion of previously deleted data; 

• Fail to have procedures to avoid allowing furnishers to report inaccuiate information; 

Within the industry I see daily the “pass the buck” attitude between the furnishers and all three 
national repositories. It’s always the repositories fault, per die furnisher and it’s always the furnisher’s fault, 
per the repositories. This attitude comes from a very simple concept “profit”. Meaning the dispute process 
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for both furnishers and repositories is a “lost profit center” for both industries. So in fact little time is put into 
the dispute process other than tlie bare bones minimum. 

Over the past five years of “re-scoring” we have seen, our updates on consumers credit files being 
deleted and/'or corrected at the bui'eau level based on the furnisher’s documentation. Then the furnisher never 
corrects their tape that was sent to each of the repositories. So in other words, it’s here today, gone tomorrow, 
and back on sometime down the road. Many times tapes override manual updates and/or automated updates. 
Many times the repositories give their customers/fumishers a certain number of days to get their “act 
together” and update their systems/tapes after a manual and/or automated update. 

Solution 

Requiring all credit furnishers to use the new Metro II format and not allow previously deleted data to be 
reinserted if the credit furnisher, CRA, and/or through rescoring made a manual update. 

E-OSCAR (The way the bureaus communicate with their data furnishers during reinvestigation) 

This system was designed to exf^ite the credit dispute process and to improve data quality, but falls 
short on behalf of both the data ftimisher and the bureau complying to assui’e maximum possible accuracy. In 
the process the bureau captures the disputed data that it has within its database and that snapshot is presented 
to the data furnisher to be verified. 

This system “can not” and “does not” have “ALL” the relevant information that the consumer 
provided to the bureau, including the lengthy description and/or letter the consumer supplied, all documents 
supplied by consumer, and any other important facts the consumer has brought to the attention of the bureau. 

The bureau breaks down the consumers detailed explanation into a two digit number with 
predeterniined canned statements like (i.e.) “not mine”, “not in bankruptcy”, “possible mixed file” and the 
list goes on. The furnisher replies with “verified as reported”, “update”, or “delete”. This system is Just not 
adequate enough in many instances to “assure maximum possible accuracy”. 

ADVERSE ACTION NOTICE UNDER FCRA- 168!m 

One of the most important sections of the FCRA and the one that gives consumers a heads up that 
something is wrong causing them financial hardship is “notice of an adverse action”. Any user and/or person 
that makes, participates in, or arranges extensions of credit for consumer puiposes is required to give the 
consumer an adverse action notice if they used in whole or in part a consumer report and their decision was 
adverse to the interest of the consumer. 

In today’s Internet based automated evaluations, automated underwriting of insurance and mortgages 
these systems deny consumers the right to see their consumer reports that were used in their evaluation. It is 
extremely unfair to consumers today with all the “risk based pricing” adjustments the GSE’s and lenders are 
using to surcharge consumers not to give the consumer their “mandatory” adverse action notice. 
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Salution 

Require all users, and any person who makes, p^icipates in, or arranges extensions of credit for 
consumer purposes to give consumer’s adverse action notice when a credit report is used and the consumer is 
offered less favorable rates and terms. Just like we do currently for insurance adverse action notices. 
CONCLUSION 

In today’s infonnation super highway world many credit grantors use automated evaluations, which 
vary from lender to lender, and these automated systems live and die on the use of credit scoring. Consumers 
are judged within seconds based principally on a credit score, in many cases it’s a PASS or FAIL decision, 
but if the consumer passes the score test many credit grantors software have built in check and balance 
systems. These systems scan the credit file looking for bankruptcies, charge offs, foreclosures, collection 
accounts, and other derogatory accounts and/or comments attached to tradelines and/or public records. The 
higher the credit score the better the rates and terms and in many cases a point up or down could be the 
difference between getting your application accepted or rejected or paying higher fees and costs. 

Scores change almost daily and the American Dream of homeownership and the consumers right to 
obtain auto and homeowners insurance should not be a “gamble” based on the time of the month you buy a 
home, refinance your home, and the month your insurance renews. No matter how industry spins it if you’re 
a victim of identity theft the largest crime we have today, errors in your credit file, merging your file with 
someone with a common name, or you have multiple files with the same hu'eau, you will still have an 
“infected” credit score which leads to higher rates and terms. It also leads to an increased credit risk for new 
lenders, lowering of consumers credit worthiness, and lowering the overall credit reputation harming both the 
consumer and the lender who lost a chance to make a good loan, which would have helped our economy. 

In today’s risked based pricing by parties from the GSE’s, lenders, and insurance companies 
consumers need the specialized attention that CRA/resellers give them. Consumers “Can’t Fight What 
They Cmi’t See” and by not allowing “transparency” for consumers in the fonn of copies of consumer 
reports, credit reports, and/or adverse action notices sent directfy to the consumer then we truly don’t have 
transparency at least on behalf of all consumers. In mortgage underwriting, inaccuracies that lower credit 
scores "cost" the borrowers—not the lenders. Rescoring services that help raise credit scores simply means 
the borrower gets the standard loan package. "Risk- based pricing" in mortgages seems to be a one-way 
street. Lenders, the GSE’s, and the repositories are destroying consumer choice because they both are 
forcing consumers to check their credit files in advance or Beware” and/or be ready to pay 

extremely high fees to re-score. If s a position consimiCTS should not have to face if we tmly believe that 
“all” consumer reporting agencies are to assure “maximum possible accuracy” during the process of 
preparing credit reports to third parties, or are we just giving “lip service” to the banking industry and the 
consumer for whom we are trying to protect, which are tiie two driving forces behind our economy? 

1 thank you, Mr. Chairman, for this opportunity to testify and present my views and the views of 
AAA American Credit Bureau. I will be happy to answer any questions you may have. 
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EXHIBIT A 


washingtonpost.com 


Bad FICO Mark? Rescore Your Credit 

By Kenneth R. Harney 


Saturday, July 14, 2001 ; Page HOI 

You've probably heard that American mortgage applicants now have ready access to those once-secret, 
triple -digit numbere that pigeonhole them as good financial risks or bad — their credit scores. 

But you might not have heard of a fast-growing service that can dramatically improve your loan prospects 
almost overnight: "rapid rescoring." This is a service now offered by dozens of local credit-reporting 
agencies around the country; it allows mortgage loan officers to request a rescoring of applicants' credit files 
at each of the three giant credit repositories -- Equifax, Experian and Trans Union. 

At the request of the loan officer, a local credit-reporting agency analyzes an applicant's files, obtains written 
corrections from creditors of any mistaken information in the files, and advises the applicant on how to 
restructure certain open credit lines to raise credit scores. Sometimes scores can be boosted by 40 to 1 00 
points or more in less than a week - all folly within the law and with the cooperation of the credit 
repositories themselves. 

With a higher score, borrowers may qualify for lower mortgage rates, lower loan fees and better tenns 
overall. Corrective rescoring can save consumers tens of thousands of dollars in long-term debt, and alert 
them to negative information sitting in their credit files. 

Consider the case of Alexandria C. Phillips, a lawyer who lives near Los Angeles. She recently sought to 
refinance a condominium she owns in Newport Beach and to buy a new house in Laguna Beach. Her idea 
was to pul! money out of the condo and use it to help with the down payment on the house. 

When she applied for mortgage money through a local broker, however, she was told that her "credit scores 
don't look too good." Phillips was tied up with a heavy courtroom schedule and didn't ask what her scores 
were or why they were low. She asked the broker to get the best tenns she could get under the circumstances 
to buy the house and refi the condo. 

The credit scores the broker referred to were "FICO" scores, the predominant quick-reference credit-analysis 
tool used by mortgage lenders, credit card issuers and others. FICO stands for Fair, Isaac and Co., the 
developer of the scoring models that ranks applicants in terms of their relative likelihood to pay their cbbts 
on time. 

FICO scores are generated by proprietary computer programs licensed by Fair, Isaac and housed at Equifax, 
Experian and Trans Union. Individuals' foil, electronic credit files are run through the software and evaluated 
for risk patterns by the statistical models. Though long kept secret from consumers by contractual 
requirements, FICO scores are now easy to obtain. Fair, Isaac and Equifax provide them on the Internet for a 
nominal charge (www.myfico.com), and the other repositories provide proprietary-scoring advisory 
infomiation as well. 

In Phillips's case, her scores when pulled on May 23 were 597 (Experian), 569 (Trans Union) and 580 
(Equifax). Scores at the three repositories usually differ I^cause of different creditor infomiation in thef 
files. 


Phillips's scores were, in a word, horrible. To qualify for the best loan quotes, borrowers generally need 
scores of 700 or better. Scores under 620 are "sub-prime" — and produce significantly higher quotes on 
interest rates and fees. Phillips's broker referred her applic^ion to a lender specializing in sub-prime, 
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damaged-credit mortgages. I'he lender, in turn, sent Phillips's files to one of the country's most prominent 
rescoring experts, Richard Lefebvre, president of AAA American Credit Bureau in Flagstaff, Ariz. 

L,efebvre immediately began checking out the negatives ("deiogatories” in credit lingo) in Phillips's file. One 
by one, with Phillips's help, the derogatories turned out to be long-standing errors on her credit files: an 
incorrect report of a delinquent payment on a credit card; a Mercedes listed as "repossessed" in her file that 
actually belonged to someone else; an incorrectly listed "collection" action against her for $1,054 in 1995. 
After requests from Lefebvre, all were corrected hy fax and sent directly to the repositories. 

Lefebvre also noticed that Phillips routinely put bills from her law office onto several credit cards. But the 
balances outstanding when the FICO scores were pulled were nearly at the limit on the cards. High aedit 
balances relative to card limits are a major no-no for FICO scores: When your limit is $10,000 and you've 
got a $9,800 balance, your score takes a hit. So Lefebvre had Phillips pay off or redistribute balances so that 
no card or credit line had a balance near the limit. 

The result? Within five days, Phillips's FICO scores jumped 200 points — taking her from a 580 to a 780, and 
from a high-risk mortgage applicant to an A-plus cream puff. 


© 2001 The Washington Post Company 


EXHIBITB 


Washingtonpost.com 


Credit Report Errors Can Prove Costly 


Saturday, June 14, 2003; Page FOl 

When you discovered an error on your credit report in connection with a mortgage application, was it easy to 
get it corrected? Or did you get a months-long runaround from tlie creditor that made the mistake and the 
credit bureau that failed to promptly amend your credit file? That’s what happened to Rep. Gary L. 
Ackerman (D-N.Y.). 

Ackerman's complaint was just one of dozens that surfaced last week during Capitol T-Iill heanngs that have 
huge potential significance to anyone who applies for a home loan. The hearings were centered on the Fair 
Credit Reporting Act, a 33-year-oId federal consumer-prolection statute that few consumers know much 
about. 

A key focus was how credit system errors and disclosure failures can cost homebuyers significantly when 
they apply for mortgages. Banking and credit industry witnesses at the hearing generally argued that while 
the U.S. credit system may have flaws, it is by far the most efficient in the world. 

Consumer advocates presented starkly different a^^ments. Shanna L. Smith, president and chief executive 
of the nonprofit National Fair Housing Alliance, said electronic mortgage underwriting systems — used by 
practically all major lenders today to quote rates to applicants — frequently cause or enable borrowers to be 
steered to higher-cost loans. 

When a loan applicant has a FICO credit score near or below a set threshold, typically the low 600s, most 
electronic underwriting systems flag the applicant and direct the lender to "manually" undervv’rite the 
transaction. So, the loan officer is supposed to show the applicant the underlying credit report data and try to 
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detemiine whether errors, omissions or other factore may be depressing the score. The consumer then can use 
the amended credit report to get a better score and lower interest rate. 

FJCO scores are generated by running credit file data from each of the three national credit repositories — 
Equifax, Experian and TransUnion — through risk-prediction software developed by Fair Isaac Corp. Scores 
range from the upper 300s to the mid-800s, with hi^ scor^ indicating lower risk of nonpayment. 

But Smith, whose organization conducts fair-lending "testing" of mortgage companies nationwide, said that 
lenders often skip the manual-underwriting step. Instead, she testified, "from interviews with hundreds of 
loan originators over the past five years, I have learned that at least half of lenders send the applicant to a 
subprime lender "rather than spend the time necessary to manually undeiwrite the loan." 

The electronic underwriting systems now in widespread use throw "many healthy, viable babies out with the 
proverbial bath water," Smith said. In effect, large numbers of credit-worthy applicants get shunted into 
subprime, high-fee mortgages that are extra profitable for lenders and investors. 

A credit agency president, Richard L. LeFebvre of AAA American Credit Bureau Inc., of Flagstaff, Ariz., 
told the hearing that although federal law guarantees consumers die right to an "adverse action" notice 
anytime their credit file data causes them a "financial hardship," mortgage applicants routinely get no 
disclosure whatsoever when an underwriting computer pushes them into a higher-cost loan. 

LeFebvre is a nationally known expert in "rapid rescoring," essentially intervening in the loan application 
process to correct or supplement credit data quickly enough to obtain the mortgage rate desired by the 
consumer. Dozeas of independent credit reporting companies nationwide are licensed to perform rescoring 
services, working tor brokers and lenders on behalf of consumer clients. 

LeFebvre provided examples of how even small corrections of erroneous data can dramatically inprove an 
applicant's credit scores. In one case, a married couple referred to his firm had a three-year credit history with 
no late payments, according to LeFebvre. Their "mid-FICO" score, the score typically used to price 
mortgages, was 731, qualifying them for close to the lowest rates in the market. 

But when a creditor erroneously reported a missed $10 payment on an account, according to LeFebvre, the 
couple's scores plunged into the 500s, throwing them into a high-rate, high-fees bracket. 

People with relatively brief credit histories tend to be affected most dramatically by erroneous negative items 
in their files, according to Fair Isaac. LeFebvre got the errors corrected on the couple's files, returning them 
to eligibility for a prime market rate on their loan. 

The upshot for you as a borrower? Always order copies of your three credit reports well in advance of any 
mortgage application and check for mistakes. (If you live in Maryland, Colorado, Massachusetts, New 
Jersey, Georgia or Vemiont, you can request a copy of each of your credit files free every year.) Equally 
important, when your loan officer uses an electronic system to underwrite your application, ask whether you 
are being quoted the best rate available in the marketplace. If not, demand to see the credit data that caused 
you to be priced higher. 


© 2003 The Washington Post Company 
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EXHIBIT C 



100 


First half 
1999 


2nd half 1999 


First Half 
2000 


2nd Half 2000 


■ Minor Issues 
H Major Errors 


AAA Credit Study #2 

^Percentage of major errors and other 
minor issues that would affect a 
Consumers Credit Scores*^ 


This data is based on using our AAA Credit Score, which compares data between the 
three National Credit Repositories. The AAA Credit Score checks for flaws and credit grantor 
problems within the credit scoring system. 


MOTEi Our AAA Credit score cannot check Ics- enm in the consumers credit file in which all three national repositories report the same 
cosninon credit grantor errors without the help and assistance of the consumer. Those types of errors are not reported incur study. 
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EXHIBIT n 

AAA CREDIT SCORE! Copyright ©2000, oH rightx reserved 

Please be advised that your client: FUNTSTONE, FRED and FEINTSTONE, WIEMA 
(report #49197) is a Candidate for ADVS/CDVS and may have their Fico score Recalculated 

The overall AAA Credit Score is: POOR Copyright ©2000, oU rights reser\'ed ® 

{excellent, good, fair, poor, fail) 

ADVS (B)scoxQis: M and is a: A on our “ADVS” grading system 

CDVS (B) score is: 79 and is a: on our “CDVS” grading system. 

ADVS (CB) score is; 57 and is a: F on our “ADVS” grading system. 

CD VS (CB) score is: ^ and is a: D on our ‘‘‘‘CDVS grading system. 

The Breakdown between Borrower and Co-Borrower per Bureau for ADVS is as follows: 

XPN“B”; HIGH XPN “CB”: LOW 
TU “B”: MED TU “CB”: MED 
EFX “B”; HIGH EFX “CB”: LOW 

The follownlng are reason codes for our AAA Credit Scoring model & ADVS/CDVS grading system: 

A: Last reporting dates differ by standard on Rev/Opn 

B: Last reporting dates differ by standard on all acet ’s 

C: Known creditors, that effect a consumers Fico scores and meets standard 

D: Credit limits on Rev/Opn acet ’s differ by standard 

H: Paying record differs by more than standard and late's within guidelines 

J: ECOA codes that meet standard 

L: Consumers have BK tradeline and meet standard on trade lines 
M: Trade lines show past due status and meet standard 
N: Consumers don 't show Bankruptcy in PB and differs by standard 
Q: Consumers have more file var's than standard 
T: Rev/Opn acet ’s above standard and balance ratio above standard 

REMEMBER: Our AAA Credit Score model and ADVS/CDVS grading system does not take into consideration 
error 's that our AAA scoring model can V see or does not know are inaccurate without the help of the consumer. 
Our scoring model is designed to provide Mortgage Lenders and Consumers a way to check the accuracy of the 
Fico score and determine what if anything needs to he done on behalf of your consumer. While this score is to he 
used only as a ''GUIDE " only to test the validity of the Fico score. Please keep in mind “WE CAN NOT” predict 
the final outcome of your consumers Fico score due to “FAIR ISAAC'S” proprietary practices. 


Copyright © 2000, all rights reserved 



474 


EXHIBIT E 

UNITED STATES OF AMERICA FEDERAL TRADE COMMISSION 
In the Matter of 

FIRST AMERICAN REAL ESTATE SOLUTIONS, LLC, 
a limited liability company. File No. 

AGREEMENT CONTAINING CONSENT ORDER 

The Federal Trade Commission has conducted an investigation of certain acts and practices of First 
American CREDCO, fnc. ("CREDCO"), a corporation. On November 30, 1997, CREDCO's consumer 
reporting business was reorganized as an operating division of First American Real Estate Solutions, LLC, a 
limited liability company ("First American" or "proposed respondent"). Proposed respondent, having been 
represented by counsel, is willing to enter into an agreement containing a consent order resolving the 
allegations contained in the attached draft complaint. Therefore, 

IT IS HEREBY AGREED by and between First American Real Estate Solutions, LLC, by its duly 
authorized officer, and counsel for the Federal Trade Commission that 

1. Proposed respondent is a limited liability company organized under the laws of California, with its 
principal office or place of business at 150 Second Avenue North, Suite 1600, St. Petersburg, Florida, 33701. 

2. Proposed respondent admits all the jurisdictional facts set forth in the draft complaint. 

3 . Proposed respondent waives: 

a. Any further procedural steps; 

b. Tlie requirement that the Commission's decision contain a statement of findings of fact and conclusions of 
law; and 

c. All rights to seek judicial review or otherwise to challenge or contest the validity of the order entered 
pursuant to this agreement. 

4. Tliis agreement shall not become part of the public record of the proceeding unless and until it is accepted 
by the Commission. If this agreement is accepted by the Commission, it, together with the draft complaint, 
will be placed on the public record for a period of sixty (60) days and information about it publicly released. 
The Commission thereafter may either withdraw its acceptance of this agreement and so notify proposed 
respondent, in which event it will take such action as it may consider appropriate, or issue and serve its 
complaint (in such form as the circumstances may require) and decision in disposition of the proceeding. 

5. This agreement is for settlement purposes only and does not constitute an admission by proposed 
respondent that the law has been violated as alleged in the draft complaint, or that the facts as alleged in the 
draft complaint, other than the jurisdictional facts, are true. While proposed respondent believes that this 
agreement and entry of the order are in its interest, proposed respondent specifically denies the allegations of 
the complaint, other than the jurisdictional facts, and denies that it or CREDCO violated any law as alleged 
in the complaint or otherwise. 

6. This agreement contemplates that, if it is accepted by the Commission, and if such acceptance is not 
subsequently withdi'awn by the Commission pursuant to the provisions of Section 2.34 of the Commission’s 
Rules, the Commission may, without further notice to proposed respondent, (1) issue its complaint 
corresponding in form and vsubstance with the attached draft complaint and its decision containing the 
following order in disposition of the proceeding, and (2) make information about it public. When so entered, 
the order shall have the same force and effect and may be altered, modified, or set aside in the same manner 
and within the same time provided by statute for other orders. The order shall become final upon service. 
Delivery of the complaint and the decision and order to proposed respondent by any means specified in 
Section 4.4 of the Commission's Rules shall constitute service. Proposed respondent waives any right it may 
have to any other manner of seivice. The complaint may be used in constming the terms of the order. No 
agreement, understanding, representation, or interpretation not contained in the order or in the agreement 
may be used to vary or contradict the terms of the order. 

7. Proposed respondent has read the draft complaint and consent order. Proposed respondent understands that 
it may be liable for civil penalties in the amount provided by law and other appropriate relief for each 
violation of the order after it becomes final. 

ORDER 

DEFINITIONS 

For the puiposes of this order, the following definitions shall apply: 
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1. The term "Fair Credit Reporting Act" ("FCRA") refere to the Fair Credit Reporting Act, as amended by 
Public Law 104-208 (Sept. 30, 1996), 15 U.S.C. §§ 1681-168iu, and as amended in the future. 

2. The terms "person," "consumer," "consumer report," "consumer reporting agency," and "file," are defined 
as set forth in Sections 603(b), (c), (d), (f), and (g), respectively, of the FCRA, 15 U.S.C. §§ 168la(b), (c), 
(d), (f) and (g). 

3. Unless otherwise specified, "respondent" shall mean First American Real Estate Solutions, LLC, a limited 
liability company, its successors and assigns, and its officers, agents, representatives, and employees. 

1 . 

IT IS ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, 
in connection with the collection, preparation, assembly, maintenance, and furnishing of consumer reports 
and files, shall comply with Section 611 of the FCRA, 15 U.S.C. § 1681i, including but not limited to the 
following provisions: 

A. Subject to Section 611(a)(3), 15 U.S.C. § 1681i(aX3), if the completeness or accuracy of any item of 
information contained in a consumer's file at respondent is disputed by the consumer and the consumer 
notifies respondent directly of such dispute, respondent shall reinvestigate free of charge and record the 
current status of the disputed information or delete the information from the file, as required by Section 
61i(a)(l), 15 U.S.C. § I681i(a)(l); 

B. As required by Section 61 1(a)(2), 15 U.S.C. § 1681i(a)(2), but subject to Section 61 1(a)(3), 15 U.S.C. § 
168H(a)(3), 

1. Before the expiration of the five (5) -business-day period beginning on the date on which 
respondent receives notice of a dispute from a consumer in accordance with Section 611(a)(1), 15 
U.S.C. § 168 li(a)(l), respondent shall provide notification of the dispute to any person who provided 
any item of information in dispute, at the address and in the manner established with the person; the 
notice shall include all relevant information regarding the dispute that respondent has received from 
the consumer; and 

2. Respondent shall promptly provide to the person who provided the information in dispute all 
relevant information regarding the dispute that is received by respondent from the consumer after the 
five (5)-business-day period referred to in paragraph B. 1 . above and before the end of the thirty (30)- 
day period beginning on the date on which respondent receives the notice of the dispute directly 
from the consumer; 

C. As required by Section 611(a)(4), 15 U.S.C. § 1681i(a)(4), in conducting any reinvestigation under 
Section 61 1(a)(1), 15 U.S.C. § l681i(aXl), with respect to disputed information in the file of any consumer, 
respondent shall review and caisider all relevant information submitted by the consumer in the period 
described in Section 61 1(a)(1)(A) with respect to such disputed information; 

D. As required by Section 611(a)(5)(C), 15 U.S.C. § 1681i(a)(5)(C), respondent shall maintain reasonable 
procedures designed to prevent the reappearance in a consumer's file, and in consumer reports on the 
consumer, of information that has been deleted (other than information that has been reinserted after the 
person furnishing the information certifies that the information is complete and accurate, as required by 
Section 6n(a)(5)(B)(i), 15 U.S.C. § 1681i(a)(5)(B)(i)); 

E. Respondent shall provide WTitten notice to the consumer of the results of the reinvestigation of any item 
disputed by the consumer under Section 611(a), 15 U.S.C. § 168 H(a), not later than five (5) business days 
after the completion of the reinvestigation of the item, as required by Section 611(a)(6), 15 U.S.C. § 
1681i(a)(6), including but not limited to: 

1. A notice that the consumer has the right to add a statement to the consumer's file disputing the 
accuracy or completeness of the information ("dispute statement"), as required by Section 
6n(a)(6)(B)(iv); and 

2. A notice, as required by Section 61 l(a)(6)(B)(v), that the consumer has the right to request that 
respondent provide either a notification that the item has been corrected or deleted, or the consumer’s 
dispute statement described in paragraph E.l. above or a codification or summary of that dispute 
statement, to any person specifically d^igrmted by the consumer who has received a consumer 
report that contained the deleted or disputed information (a) within two years prior to the consumer’s 
request, for employment purposes; or (b) within six months prior to the consumer's request, for any 
other purpose; 
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F. If the reinvestigation under Section 611(a), 15 U.S.C. § 1681i(a), does not resolve the consumer's dispute, 
respondent shall pemiit the consumer to file a dispute statement, as required by Section 6 1 1 (b), 1 5 U.S.C. § 
1681 i(b); 

G. As required by Section 611(c), 15 U.S.C. § 1681i(c), whenever a consumer files a dispute statement 
pursuant to paragraph I.F. above, respondent shall include the consumer's dispute statement, or a codification 
or summary of the dispute statement, in all subsequent consumer reports that respondent prepares concerning 
the consumer that contains the information in question, unless respondent has reasonable grounds to believe 
the dispute statement is frivolous or irrelevant; and 

H. Respondent shall, at the request of the consumer, provide a notification, as required by Section 61 1(d), 15 
U.S.C. § 1681i(d), that a disputed item has been corrected or deleted, or the consumer's dispute statement or 
a codification or summary of that dispute statement, to any person specifically designated by the consumer 
who has received a consumer report that contained the deleted or disputed information (a) within two years 
prior to the consumer's request, for employment purposes; or (b) within six months prior to the consumer's 
request, for any other purpose. 

II. 

11^ IS FURTHER ORDERED that respondent and its successors and assigns shall for five (5) years maintain 
and upon request make available to the Federal Trade Commission for inspection and copying all business 
records demonstrating respondent's compliance with the terms and provisions of this order. 

III. 

IT IS FURTHER ORDERED that respondent and its successors and assigns shall deliver a copy of this order 
to all current and future principals, officers, directors, and managers, and to all current and future employees, 
agents, and representatives having responsibilities with respect to the subject matter of this order, and shall 
secure from each such person a signed and dated statement acknowledging receipt of the order. Respondent 
shall deliver this order to such current personnel within thirty (30) days after the date of service of this order, 
and to such personnel hired after such date within thirty (30) days after the person assumes such position or 
responsibilities. 

IV. 

IT IS RJRTHER ORDERED that respondent and its successors and assigns shall notify the Commission at 
least thirty (30) days prior to any change in respondent that may affect compliance obligations arising under 
this order, including but not limited to a dissolution, assignment, sale, merger, or other action that would 
result in the emergence of a successor entity; the creation or dissolution of a subsidiary, parent, or affiliate 
that engages in any acts or practices subject to this order; the proposed filing of a tenkruptcy petition; or a 
change in the entity name or address. Provided, however, that, with respect to any proposed change in the 
entity about which respondent learns less than thirty (30) days prior to the date such action is to take place, 
respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices 
required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, 
Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580. 

V. 

IT IS FURTHER ORDERED that respondent and its successors and assigns shall, within sixty (60) days 
after the date of service of this order, and, thereafter, within thirty (30) days of such other times as the 
Federal Trade Commission may require, file with the Commission a report, in writing, setting forth in detail 
the manner and form in which it has complied with this order. 

VI. 

This order will terminate twenty (20) years from the date of its issuance, or twenty (20) years from the most 
recent date that the United States or the Federal Trade Commission files a complaint (with or without an 
accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; 
provided, however, that the filing of such a complaint will not affect the duration of: 1. Any Part in this order 
that terminates in less than twenty (20) years; 2. This order's application to any respondent that is not named 
as a defendant in such complaint; and 3. This order if such complaint is filed after the order has temiinated 
pursuant to this Part. Provided, further, that if such complaint is dismissed or a federal court rules that the 
respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or 
upheld on appeal, then the order will teiminate according to this Part as though the complaint had never been 
filed, except that the order will not terminate between the date such complaint is filed and the later of the 
deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. 
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PREPARED STATEMENT OF DAVID A. JOKINEN 

Sugar Land, Texas 

July 10, 2003 

Mr. Chairman, Ranking Member, and Committee Members. Thank you for allow- 
ing me to appear today. I will share with you my 2-year nightmare of being declared 
a “dead man walking.” It is a little harder to get credit when the depositories report 
you as “deceased.” 

Personal Background 

I am a self-employed suburban businessman running my own real estate develop- 
ment firm. I am 67 years old. In the past, I have been a guest professor at 2 euro- 
pean universities, plus two graduate schools here in the States. I authored 3 books 
on engineering and architecture. They were published in Holland. I wrote them in 
a foreign language. I have also been an urban affairs/town planning consultant to 
numerous Governments in Canada, Europe, and the United States. 

I have also been a senior executive with a major department store chain. For the 
last 35 years, I have been a self-employed businessman. 

The Day My World Turned Upside Down 

My 95-year-old mother passed away on April 30, 2001, in a Houston nursing 
home. I later discovered that because of a clerical error I also “died” that day. 

My mother had credit cards with 3 banks, (Chase Bank, Bank One, and People’s 
Bank). I was also a signer on all three cards. Within 24 hours of her death I called 
all 3 banks to say I would honor my mother’s bills; and would send them each a 
death certificate as soon as I got it. Two weeks later, I contacted all 3 banks to 
verify they received their copy of mom’s death certificate. I also asked if it was now 
“okay” for me to begin reusing their card solely in my name. All 3 said “fine.” 

Much to my surprise, I received a form letter from Chase Bank, 1 month later, 
asking for a copy of mom’s death certificate. I called and asked Chase Bank what 
they did with both the hard copy I mailed and the fax copy I sent weeks earlier. 
They casually said, both probably got lost in their huge filing system. Could I resend 
them another? This cavalier attitude prompted me to formally ask Chase Bank for 
a written confirmation that they had removed my mother’s name and her Social Se- 
curity number off this Chase Bank Visa card. I made that request more than 2 
years ago. I have still not received their promised written confirmation. How long 
should I wait. 

Five months after mom’s death. Chase Bank did send a different form letter. It 
said I was now the sole name on this Visa card. They also sent me 2 additional 
cards, (for this account) with my name on them, why? I do not know? I never asked 
for them? Both, Bank One and People’s Bank had sent me their letters more than 
4 months earlier. 

Cascading Consequences of One Clerical Error 

Suddenly, this whole other world of credit bureau problems came crashing into 
my life. After some detective work, I discovered Chase Bank was the sole culprit 
reporting me dead to all 3 credit depositories. They “mixed up” my mother’s death 
with my Social Security number. 

The 3 bureaus seemed to have embedded this error in different locations on their 
recirculating data loops. It seems that on each different month my death notice 
shows up from a totally different depository’s report. They seem to be pla 3 dng a per- 
verted version of the “book of the month club.” Only now, it is “David’s Death of 
the Months.” It was becoming ghoulish. The whole thing was starting to send chills 
down my spine. 

Two Out of Three 

The first time we noticed that 2 credit bureaus had declared me “deceased” on 
the same month was later in the fall of 2001. 

Mortgage interest rates had been falling dramatically, so my wife and I decided 
to refinance our house. The mortgage broker called back a few days later, and said, 
“We have a strange problem.” Only one bureau gave her a credit score. Experian 
claimed they could not calculate a Fair Isaac score because David was dead. Equifax 
said their Beacon score was not available because the subject was deceased. Today, 
without 2 out of 3 credit scores, no one gets a residential mortgage, we certainly 
did not. 

I immediately purchased copies of my credit reports from both bureaus. Both 
showed Chase Bank reported me dead on one Visa Card. Ironically, I was still alive 
as far as my other Chase Bank credit card with them was concerned. 
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I followed the FTC printed consumer guidelines for correcting these errors. I 
mailed in my corrections and waited 30 days. I then purchased new copies of my 
reports from both Experian and Equifeix. I naively expected them to be clean. When 
the same dirt was still there, I called both bureau’s and said “Hello people, I am 
really not dead.” Help me correct this. 

Both bureaus said the same thing. “They had forwarded my complaint to Chase 
Bank, and Chase has not responded.” I asked what is next? They said case closed. 
They harshly explained that I, as a little consumer, was not their client or customer. 
I was just another number for them to make money off. In this case, their client 
was chase, (a rich bank); and their customers were all the other banks, retailers, 
etc., who regularly paid them big dollars for thousands of reports at a time. 

They just did not care if I was dead or alive, on paper, or in reality. Equifax told 
me to quit bothering them, and go away. Experian lost their temper. They threat- 
ened me by sa 3 dng they would put more dirt on my report (so they could make more 
money) if I did not hang up. 

Deal Directly With The Source 

Chase Bank was the only creditor reporting this problem. So, on the very next 
business day (in November 2001) I called, and faxed. Chase Bank. I asked them how 
a responsible and ethical bank could report such a malicious lie. Their only response 
was “They were sorry if it bothered me.” They said they would communicate with 
both Equifax and Experian saying that my death was an error and inaccurate. I 
said thank you. I thought that finally would be the end of it. That was how the Fair 
Credit Rraorting Act was supposed to work. I finally slept sound that night, after 
months of agony. 

A few days later, I called to verify their correction process was in the works. I 
was shocked when the supervisor at Chase Bank gave me a noncommittal answer — 
saying, “it was routinely handled.” This supervisor refused to give me his name. 
Later, when I told a depository employee this conversation — they laughed. They said 
that it was “insider code” for throwing my correction request into the trash can. 

It was at this moment of anger, plus insight, that I truly realized what a “tooth- 
less paper tiger” all the Federal legislation on credit protection really was. None of 
the “Big Players” in this industry obey any of these rules and guidelines set forth 
by Congress. They have told me, “since there are no tough policemen daily watching 
their actions it was still “business as usual.” 

Sure, the FTC makes a headline now and then with consent settlements against 
each of the big 3 depositories. But, they said that was only a minor irritant. The 
only action they might fear is legislation making their individual managers person- 
ally responsible for their groups’ error rates, under penalty of hefty personal fines, 
and/or jail time. They mentioned the SEC’s forced collapse of Arthur Anderson and 
other firms. 

A Serious Disconnect Between Words and Results 

I am a living case example of how our current fair credit reporting laws still do 
not work as intended. They sure sound great on paper. 

I remember reading (in 1994), the Senate finally shifted the “Burden of Proof’ for 
the accuracy of information off the back of individual consumers, and onto the 
shoulders of the 3 giant credit bureaus, and their associated creditors. That sounded 
wonderful. It was the fair thing to do. However, it is now 9 years later, and hardly 
anything has really changed. We, the consumer, are still stuck with the “burden of 
proving” any “error” on our report is a fabrication, or “mix up” from some other file. 

Over the last 26 months I have asked Chase Bank to either prove I am dead, or 
quit reporting that lie. “Off the record,” people at Chase Bank have told me that: 
(A) Until there is either a financial incentive, to correct errors, or (B) Until the pen- 
alty on both a company and it’s staff is so severe it cannot be ignored “little” inac- 
curacies like mine will never be given the proper attention or time to get corrected. 

I Had To Prove I Was Alive 

After 2 years of struggling to find any courageous lender to refinance my home, 
a friend took pity on me. He is a mortgage banker. He found a sophisticated na- 
tional lender who was willing to work outside the box. Now, when that nasty mes- 
sage: “Only 1 bureau this month will give me a Fair-Isaac score popped up,” he was 
prepared. Most mortgages today end up in the secondary market. Either “Freddie 
Mac” or “Ginnie Mae” typically sets the guidelines for that. So, why not try to get 
some Federal Government Agency (on paper) to declare, “Jokinen is alive.” 

A Visit To The Government 

Last month, I walked into the Houston Regional Office of the Social Security Ad- 
ministration, and begged them to write a Government letter saying that I was not 
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dead. Under Federal law, this is Chase Bank’s or the 3 credit bureaus responsibility 
to prove, or disprove. But, those fat cats only “yawned in my face” every time I re- 
quested they correct this glaring inaccuracy. 

At first, the employees in the Social Security office did not know what to do with 
my request. There was not a sample letter on this topic in their Federal handbook. 
They decided to call their supervisor in Washington, DC. I also had to talk to some 
higher official in the national capital, who then asked to speak again to the Houston 
Office Manager. These two talked some more, and then started laughing. Soon, all 
the clerks in this entire Social Security office started whispering to each other and 
then laughing. A few minutes later my human interest story spread out into the 
waiting room. 

My request for this unusual letter was being translated into Chinese, Vietnamese, 
Spanish, etc. As people started hearing my strange story in their language, they 
started laughing too. Soon the entire floor in this high rise was laughing. I was now 
the object of much pity. 

When the Social Security Manager finally presented me with my “Living Letter,” 
the entire waiting room broke out into applause. It was like “little David going out 
to slay the Goliath Bank.” Yes, my wife and I finally got our home’s mortgage refi- 
nanced. But, it was not from any help given by the Federal Fair Credit Reporting 
Act. 

What Happened To The 30-Day Rule? 

The 1994 Act required creditors and depositors to furnish only “accurate” informa- 
tion. Who enforces this? When consumers dispute any data these bureaus have 30 
days to theoretically correct those errors. Is this a fairy tale? I have never seen it 
happen in real life. 

Chase Bank has “inaccurately,” reported me dead for more than 26 months. They 
still have not lifted one finger to update or to correct their inaccuracy. Then, 1 year 
after Chase Bank had declared me “deceased,” they mailed me an offer to raise the 
credit limit on that same Visa card in dispute, to $10,500, with “zero” interest on 
balance transfers for 9 months. 

Is this a question of their right hand not knowing what the left hand is doing? 
Or, was it just a profit-hungry bank looking to make a buck off a dead man’s ac- 
count? Chase Bank, also, sent me an unsolicited $5,000 preprinted check to pay off 
competitor bank card accounts. This was beginning to look like the old “Abbott and 
Costello” comedy routine: “What’s on first, who’s on second?” Except this bank is no 
longer funny to me. What a phony slogan Chase Bank claims to have: “The right 
relationship is everything.” The only relationship Chase Bank has ever given me is 
“dead man walking.” 

Ten years ago. Congress was moved to considering new fair credit reporting laws. 
This move came after research revealed “in 1991 consumers had to complain an av- 
erage of 23 weeks before getting minor corrections on their credit reports.” By 1993, 
it got worse. Consumers had to now complain for a longer average of 31 weeks be- 
fore getting any satisfaction. 

My 30 Days Has Grown To 784 Days 

I have been complaining to all 3 Giant Credit Bureaus, (plus Chase Bank) for over 
112 weeks — and still, I get no satisfaction? Rodney Dangerfield described America’s 
current consumer plight best — “We get no respect!” How many more weeks do I have 
to “ask” these giants to grant me my consumer credit rights that were supposedly 
authorized by Congress 9 years ago? 

My Damages 

The costs of this credit bureau screw-up to me keep mounting monthly. It is an 
ever-increasing financial burden. I discovered I have been spending an average of 
7 hours each week, just keeping these mounting credit errors under control. This 
comes to 364 hours a year with my finger stuck in this “Dyke of Inaccurate Data.” 
I am afraid if I pulled my finger out, I would be totally inundated in a swirling sea 
of paper lies. If their flood of bogus reports became more overwhelming it will im- 
pair my ability to economically support my family. For the last dozen years, my 
minimum rate for consulting has been $50 per hour. So far, I have expended 798 
hours on just trying to keep Chase Bank and the “3 Stooges” (the 3 bureaus) under 
control. That has cost me $39,900, so far. 

Paying much higher monthly mortgage payments over the last 2 years than I now 
have has already cost me an additional $11,000. Also the higher interest rate 
slapped on us when we purchased my wife’s used car has already cost us another 
$2,500. 

I am currently trying to raise money from investors. I am starting a new type 
of Home Building Company. We will build new modular homes in 6 weeks, instead 
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of the regular 6 months. These new homes will also be hurricaneproof (up to wind 
speeds of 130 mph), floodproof (up to 2 feet above your neighbor’s living room floors), 
and mold resistant. These new homes look identical to any conventional stick built 
homes on the same block. One of my potential investors (a $200,000 prospect) told 
me he pulled a merged credit file on me, and it scared him off. That is an additional 
$200,000 investment that should have been generating profits for my new corpora- 
tion. These itemized monetary damages today add up to, more than $250,000, and 
counting. 

Emotional Suffering 

I was my mother’s only child. We were quite close. My mother had Tuberculosis 
during World War II. She was confined to a TB sanitarium in Detroit for 3 years. 
My mother left our house when I was 6 years old. I never saw her in person again 
until I was 8 years old. In 1943, the TB doctors removed half of my mother’s lung. 
During her recovery, the TB doctor told my mother she probably only had 2 to 5 
more years to live. That is because she was now living on only half a lung, and it 
would eventually wear out. That was when she was 39 years old. She actually lived 
to 95. Because of Chase Bank’s stupidity, I have now relived her last few painful 
years over and over again — while trying to get this mess cleared up. 

Suggested Legislation 

It seems most consumer complaints are the same: The majority of errors on their 
credit report do not get corrected. And, when some did, it wasn’t in a timely fashion. 

Solution 

Give the FTC the same licensing and oversight powers the SEC currently has 
over stock and bond brokers. 

That way, all future credit reports would go out under a full name and FTC li- 
cense of the bureau’s assigned manager for that specific account. Then consumers 
would not be unfairly negotiating with nameless, faceless, customer services clerks 
they will never speak to again, the next time they call in or write. Under this re- 
form, trained and licensed persons on the other side would be fully responsible for 
handling consumer corrections in 30 days. 

Then, if major mistakes are made or not corrected, the FTC should be granted 
the same SEC powers of serious fines against individuals, and/or their employing 
firms. The FTC should be able to take away an individual’s license to work in this 
credit industry. The FTC should also be able to set jail time for those found guilty 
in court. 

Solution Continues 

Not only should the 3 depositories be required to license various levels of their 
staffs — this should also apply for all creditors who regularly supply the 3 credit bu- 
reaus with their information. 

That means all future credit reports would also carry another set of contact 
names of licensed people after: (1) Each bank’s entry (like Chase), (2) Each retailers 
entry (like Sears), (3) Each lender’s entry (like Countrywide), (4) Each insurers 
entry (like State Farm), and so forth. The best way to reduce complaints in any in- 
dustry is to professionally train all staff who must deal with the consumer. Then 
hold each of those licensed staff people individually accountable for their own report 
corrections, or lack of corrections. 

Thank you for your time and courtesy today. 
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V IIMES 

EVAN HENOBICKS- 



Testimony of 

Evan Hendricks, Editor/Publisher 
Privacy Times 
www.privacvtimes.com 

Before The Senate Banking Committee 
July 10, 2003 

Mr. Chairman, Ranking Senator Sarbanes, distinguished Members, thank you for the 
opportunity to testify before the Committee. My name is Evan Hendricks, Editor & Publisher of 
Privacy Times, a Washington newsletter since 1981. For the past 25 years, I have studied, 
reported on and published on a wide range of privacy issues, including credit, medical, 
employment, Internet, communications and government records. 1 have authored books about 
privacy and the Freedom of Information Act. I have served as an expert witness in Fair Credit 
Reporting Act and identity theft litigation, and as an expert consultant for government agencies 
and corporations. 

1 was closely involved in the six-year process that resulted in the 1996 Amendments to 
the Fair Credit Reporting Act. An important lesson to be drawn from that exercise is that the 
best way to improve our national credit reporting system is to strengthen protections for 
consumers. The more power that consumers have to maintain reasonable control over their 
credit reports, the better the chances for improving their accuracy and ensuring they will be used 
fairly and only for permissible purposes. 

The 1 996 Amendments aimed to address several problems, including chronic inaccuracy, 
non-responsiveness and inadequate reinvestigations by consumer reporting agencies (CRAs) and 
furnishers, the reinsertion of previously deleted data and the impermissible use of credit reports. 
Congress recognized that the evolution of a reporting system that became more national in scope 
and more automated also necessitated a legal evolution that would further empower consumers 
to be the guardians of their own data. Congress has always recognized that the States play an 
important role in advancing consumer protection, both through enforcement and innovative 
legislation. 

The record is clear that credit report inaccuracy, inadequate reinvestigations, CRA and 
furnisher non-responsiveness, reinsertion and impermissible use persist to this day as serious 
problems that are damaging to consumers and the credit reporting system itself Moreover, our 
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laws for protecting the privacy of financial data not covered by the FCRA are woefully 
inadequate. Thus, it is imperative that Congress further strengthens the FCRA and national 
financial privacy laws, and gives the States more freedom to act in ways that are consistent with 
the overall national goal of protecting consumer privacy. 

The unfortunate reality under the current system for many consumers who are victims of 
inaccurate credit reports and/or identity theft is that they can only force CRAs and furnishers to 
truly reinvestigate and correct emors by filing a lawsuit. I have seen cases in which consumers 
followed all the normal procedures to get errors corrected, only to find that inaccurate 
information was “verified” as reported, or previously deleted information was reinserted. In 
these cases, the procedures of CRAs and furnishers were simply unable to achieve accuracy. 

As I will detail in this statement, the market forces (i.e., the high volume of disputes 
and cost of personnel) has created a regime that is tolerating significant, and probably 
unacceptable, levels of inaccuracy. For those consumers, this creates a corresponding chain of 
damages. It also raises serious questions about the accuracy and integrity of the data in the 
national credit reporting system. 

In fact, the CRAs, as a matter of policy, give priority treatment for people that have filed 
suit or have threatened to sue. In my opinion, CRAs have calculated that it costs less to fend off 
the occasional lawsuit than to invest the resources necessary to prevent the problems that caused 
credit report inaccuracies to become the leading cause of complaints to the FTC in 1991-93. The 
CRAs are probably correct. Filing suit under the FCRA is a daunting and arduous task, due to 
the enormous discovery challenges and defense litigation tactics. There is only a small 
community of plaintiffs’ attorneys that specialize in the area. I have spoken with consumers that 
could not on their own find an attorney to represent them. 

The 1996 Amendments attempted to preclude the need for litigation by specifying a 
higher standard of care for CRAs, furnishers and users of credit reports. We need to recognize 
the reality that the Amendments have not achieved their goal and that in too many instances 
consumers who want to protect their good name must sue. 

Considering that CRAs keep records on some 1 90 million Americans, we also must 
recognize that we will never be able to build a bureaucracy big enough to enforce Americans’ 
right to credit report accuracy and privacy. Therefore, it is necessary to “democratize” 
enforcement by strengthening individuals’ authority' to protect their own rights. 

We discovered in 1970 that the advent of a national credit reporting system posed 
significant threats to privacy and fairness, and we enacted the FCRA. In the early 1990s, we 
discovered that the statute was not adequate to protect privacy and encourage accuracy, and 
enacted the FCRA Amendments in 1996. Today, the evidence is compelling that the current law 
is still inadequate and must be strengthened, and that the States have played and will continue to 
play an important role in protecting consumers and improving the system. 



483 


Upgrading Access Rights In Light of 21” Century Technological Capabilities 

The best way to ensure accuracy is for consumers to be “plugged into’’ their own credit 
reports, just as our current credit reporting system potentially “plugs” thousands of credit 
grantors, employers and insurers into the credit reports of all Americans. 

There are many advantages to consumers having electronic access to their credit 
histories, and to receiving alerts as to when new data are entered or when there are inquiries. 

First, consumers can see immediately if there was inquiry from an improper source, possibly 
indicating identity theft. Second, they promptly will learn of inaccurate information. If 
accompanied by an electronic communications channel, it makes disputes cheaper, faster and 
more convenient. Third, it accommodates the goal of notifying consumers whenever negative 
information is placed on their credit report - at a very low cost. In my opinion, the best 
procedure for maximizing accuracy and today’s electronic environment is providing consumers 
with instant access to their credit reports and real-time alerts to any new information or inquiries. 

The good news is that the CRAs now offer these sorts of monitoring and alert services. 
However, one piece of bad news, as Prof. ,Ioel Reidenberg pointed out in the Committee’s last 
hearing, “Experian appears to use registration for these services as a means in the legal 
boilerplate to provide notice and opt-out for affiliate sharing. In other words, consumers 
particularly concerned about the sanctity of their credit reports are likely to enable inadvertently 
the sharing of their data by the credit reporting agency with affiliates outside the protections of 
the FCRA.” 

Tlie other bad news is that the charges for these services are excessive. The Equifax 
“Gold” service, which includes online access to your credit report, “daily alerts,” and “ID Theft 
Insurance” goes for $9.95 per month, or $1 19.40 per year. A one-year subscription to the 
Experian alert service costs $79,95 per year. 

A new survey by Privacy & American Business (P&AB) and Harris Interactive indicated 
that 33,4 million Americans have bought a privacy product to avoid identity theft, check their 
credit report, or surf or shop online anonymously. These figures represent a privacy product 
market value of approximately $2.5 billion. Credit check and identity theft protection products 
range from $69.99 to $1 19.99 annually and anonymizers range from $50 to $100 annually for an 
average privacy product price of $75, the survey said. 

The FCRA caps the price of a credit report but the monitoring and alert subscription 
services represent an “end-run” around the Act’s intent to encourage access by prohibiting 
excessive charges. It is nice that a consensus is forming that all Americans should be entitled to 
one free credit report per year. But that’s really more like a horse-and-buggy approach in today’s 
environment. The FCRA can encourage better consumer access to their own data by capping the 
price of monitoring services. In fact, this is one place where there could be a “win-win.” Let’s say 
a CRA is charging 1 million consumer $80 a year for amiual revenue of $8 million. Wouldn’t it be 
better if 30 million American were paying $10 per year for annual revenues of $300? Finally, 1 see 
plugging people into their own data as a model for facilitating consumer access to other types of 
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personal data. However, we must put an end to the current affiliate-sharing opt-out regimes that 
undermine fair information practices. 


CRA Methods Can Cause Inaccuracy 


A fundamental problem with inaccuracy is that it can cause the unjust denial of credit. 

In several of the cases in which I have served as an expert witness, CRAs have mis- 
merged data about two different consumers because their algorithms tolerate what’s known as 
“partial matches.” If you are an unlucky consumer who gets on the wrong side of a CRA’s 
algorithms, your life can become a nightmare. 

First, a brief description of how the database systems of the three major CRAs operate. 
The credit grantors (furnishers) regularly send the CRAs millions of bits of data on consumers’ 
payment histories. The CRAs store this information in a massive database that includes 
information on virtually all American adult users of credit. \Wien a consumer applies for credit, 
the credit grantor (subscriber) relays to the CRA identifying data from the consumer’s credit 
application, at a minimum, name and address, often the SSN, and sometimes date of birth. 
Applying this identifying or “indicative” data, the CRA’s algorithm then decides which 
information in the database relates to or “matches” that consumer, and then “returns” to the 
credit grantor (subscriber) a consumer credit report consisting of these data. 

The algorithm has a list of factors it considers when deciding which data in the database 
apply to which consumers. A key factor is the SSN. Other factors include first name and last 
names and geographic region. 

From the CRA’s point of view, an important goal is to provide the credit grantor with all 
data it has about the consumer and to ensure that nothing is missed. Therefore, the CRA seeks to 
maximize disclosure of any possible information that might relate to consumer about whom a 
subscriber inquires. To accomplish this, the algorithm is designed to accommodate such errors 
as transposed digits within SSNs, misspellings, nick names and changed last names (women who 
marry), by accepting “partial matches” of SSNs and first names, and in some circumstances, 
assigning less importance to last names. 

In my opinion, the manner in which CRA’s systems tolerate partial matches has been a 
primary cause of mixed files and other inaccuracies, and has been readily exploited by identity 
thieves. 


For example, the testimony in the case of Judy Thomas, a resident of Klamath Falls, 
Oregon, was that Thomas’ SSN was only one digit different than that of Judith Upton, of 
Stevens, Washington. This, probably coupled with partial matches on first name, caused the 
CRA’s algorithm to assume that the one-digit difference was a clerical eiTor and that Thomas 
and Upton were the same person, with one SSN. Many of Upton’s derogatory trade lines were 
improperly merged on to Thomas’ credit report, causing delays in obtaining a mortgage and 
other hassles and distress. 
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In the case of Myra Coleman, of Mississippi, Maria Gaytan, of California, applied for 
credit using Ms. Coleman’s SSN, creating an exact match of the SSN. This exact match allowed 
CRA’s algorithm to tolerate major and obvious differences in last name, address. City, State and 
date-of-birth. Gaytan’s derogatoiy' trade lines then polluted Coleman’s credit report. 

Then there is the case of Carol Fleischer, who was improperly merged with Carolyn 
Cassidy. In 1991, when she applied for credit, the CRA’s algorithm saw there was another 
“Carolyn” (albeit Cassidy) living in Michigan (albeit Highland, instead of Ann Arbor) and an 
SSN with only one digit difference. This caused Cassidy’s negative trade lines to be merged into 
Ms. Fleischer’s credit report, which was then returned to the credit grantor to which Ms. 
Fleischer had applied for credit. But in 1997, Ms. Cassidy apparently put Ms. Fleischer’s SSN 
on Cassidy’s credit applications. Again, the exact SSN match, coupled with a partial match in 
the first name and market area, allowed the CRA algorithm to tolerate obvious differences in 
several other data fields. In sum, instead of using the SSN as a tool for inaccuracy, in these 
situations, the CRA converts the SSN into a tool for inaccuracy. 

In certain circumstances, some CRA algorithms tolerate a partial SSN match of 7 or 8 out 
of 9 digits. In my opinion, this is inconsistent with separate consent agreements between the 
CRAs and either the State Attorneys General or FTC to use “Full Identifying Information,” 
defined as “full last and first name; middle initial; full street address; zip code; year of birth any 
generational designation; and social security number.” 

(See “Attachment 2.” Also see EPIC’s submission to the committee.) 

Inadequate Reinvestigation. Major Volume 

It can be very problematic for consumers when a CRA improperly mixes their data with 
someone else. But it can be extremely maddening when the CRA then fails to “mimix” it after 
errors are disputed. 

Every independent study of the credit reporting system has found significant levels of 
inaccuracy. This includes the most recent studies from the Consumer Federation of America and 
the Federal Reserve Board, and a succession of studies by the U.S. Public Interest Research 
Group and Consumers Union ranging back to 1 990. 

In my opinion, another indication of inaccuracy is the large volume of disputes received 
by the CRAs. The estimates are that CRAs receive from anywhere between 5,000 to 25,000 
consumer disputes per day, with 7,000-1 0,000 being the more typical range, CICA dispute 
handlers are expected to handle between 10-12 consumer disputes per hour. Because each 
consumer dispute averages three disputed items, this means the CRA employee only has a few 
minutes to handle each disputed item (36 disputed items, divided by 60 minutes = 1 .66 minutes) 

Credit grantors have seen a jump in dispute volume as well. For instance, in October 
200 1 , Capital One received about 1 ,000 disputes per day, according to a company official. By 
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May 2002, it had grown to 2,000 disputes per day. The official said the number of disputes has 
now grown to 4,000 per day. 

To deal with this volume, the CRAs and furnishers have set up an automated system for 
exchanging messages when consumers dispute inaccuracies in their credit reports. For example, 
a consumer writes to the CRA to dispute inaccurate information in his or her credit report. The 
consumer’s letter provides detail of the errors. Supporting documentation is attached. But rather 
than forward this information to the furnisher, the CRA typically reduces the consumer’s dispute 
to a two-digit code (usually meaning “Not Mine”) and sends it to the furnisher. The furnisher 
typically will only check to see if the information it previously furnished is the same information 
it has on tile. If it is the same, then the furnisher “verifies” the previously furnished information. 

In other words, market forces, i.e., the high volume of disputes and the cost of human 
resources, have prompted the financial services industry to cut corners when it comes to FCRA 
reinvestigations. 

This process is particularly maddening for consumers who are victims of mixed files 
and/or identity theft. For instance, when Judy Thomas disputed information generated by Judith 
Upton, the furnishers “verified” the information because they previously had reported the same 
information about Judith Upton. 

Of course, this is a huge breakdown in how the system is supposed to work. In the 1996 
Amendments, Congress specifically required CRAs to “forward all relevant information” 
concerning a consumer dispute to the furnishers. All parties were required to conduct 
reinvestigations. This two-dimensional message exchange does not amount to a true 
reinvestigation. (My Webster’s New Collegiate Dictionary defines "investigate" as "to observe 
or study by close examination and systematic inquiry." One of the definitions of "systematic" is 
"marked by thoroughness and regularity.") 

The previous testimony before the House by Leonard Bennett, a Virginia consumer 
attorney, provides great detail as to the defects in this process. The bottom line is that the current 
“reinvestigation” process engaged in by CRAs and credit grantors is not designed to find the 
truth. Like Mr. Bennett, I quote from a deposition of the Capital One employee responsible for 
consumer disputes, who was being questioned by Michigan attorney Ian Lyngklip. 


Q For purposes of how you administer to the 
FCRA, does the underlying truth of the matter enter 
into the decision? In other words, if the information 
in Cap One's system is not, in fact, true, is Cap One 
going to veri fy the data as accurate as long as it 
matches? 

A Not — if we — if we do not — I'm not 
quite sure if you're — are you — restate that 
question. 

Q Sure, I can do that. Cap One, as a matter 
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of how it administers to the FCRA -- 

A Uh-huh. 

Q - and looks at the accuracy requirements, 
does not equate accuracy with truthfulness, what it 
does is it measures accuracy in terms of whether or 
not the data matches between what's in the credit 
reporting system and what's in Cap One's computer; is 
that a fair statement? . . . 

A So your, your — the way the question is 
posed to me makes it sound like I have to choose 
between whether I'm saying what my associates do is 
accurate or truthful but not both, 

Q Well, no, what I'm asking is this: Is it 
possible, is it possible that Cap One will verify 
information that is not, in fact, truthful? 

A There's a possibility of that. It certainly 
would not be done intentionally. 

Unfortunately, 1 have seen several cases in which furnishers “verified” derogatory data 
about consumers that simply was not true. So far, several of the major credit grantors use a 
similar, two-dimensional system, and the CRAs appear to encourage them to do so. In the near 
future, I intend to write a letter to the CRAs advising them that the reinvestigation procedures of 
several major furnishers do not adhere to a sufficiently high standard of care and are not 
designed to effectuate a true re investigation. Similarly, 1 intend to advise the furnishers that the 
CRA’s, as a matter of course, often fail to forward to them all relevant information provided by 
the consumer, again, undermining the reinvestigation process. 

Other problematic procedures by either the CRAs, furnishers and users include; 

• Raising interest rates on consiuners who were never late, but based on review' of their 
credit reports 

• Continuing account reviews well after a consumer has terminated a relationship with 
a creditor 

• Using the national credit reporting system as an arm of debt collection in an unfair 
manner 

• Lack of consistency in issuance of adverse action notices 
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The Damaging Nature Of Inaccuracy. Non-Responsiveness, Faulty Reinvestigations & 
Identity Theft 

I will try to briefly summarize some of the ways in which consumers are damaged by 
inaccurate credit reports, non-responsiveness and faulty reinvestigations by CRAs and furnishers. 

• Inaccurate data can lead to the unjust denial of credit or insurance 

• In the age, of risk-based pricing, inaccuracies can result in the granting of credit or 
insurance on less favorable terms. 

• Seeking to facilitate coirection of inaccuracies can be time-consuming, causing a loss 
of time, energy and opportunity. 

• Often the most profound damage that consumers suffer is the emotional distress that 
accompairies: the discovery of inaccuracies in one’s credit report; and/or the 
frustrating process of trying to con'ect errors that were to not of one's own making; 
and/or the unjust denial of credit; and/or of being told that false information about 
you has been “verified,” and/or that information that was previously deleted as 
inaccurate was reinserted without notice. 

It also is distressful not knowing everyone who may have associated you with 
highly derogatory credit data. It can be difficult to maintain constructive personal 
relationships under stress. It can be difficult to perform adequately at one's job. 

With identity theft, all of the above damages apply, compounded by the fact that a 
criminal is joyriding on your good credit, ruining your name. 

In fact, some of the worst damages resulting from identity theft relate to the 
consumer’s frustrating interaction with the national credit reporting system. As .lodie 
Bernstein, former head of the FTC's Bureau of Consumer Protection testified ,Tuly 1 2, 

2000 before the Senate .ludiciaiy Subcommittee on Technology, Terrorism and 
Government Information, 

"The leading complaints by identity theft victims against the consumer 
reporting agencies are that they provide inadequate assistance over the phone, or 
that they will not reinvestigate or correct an inaccurate entry in the consumer's 
credit report. In one fairly typical case, a consumer reported that two years after 
initially notifying the consumer reporting agencies of the identity theft, following 
up with them numerous times by phone, and sending several copies of doeimients 
that they requested, the suspect's address and other inaccurate information 
continues to appear on her credit report. In another case, although the consumer 
has sent documents requested by the consumer reporting agency three separate 
times, the consumer reporting agency involved still claims that it has not received 
the infonnation." http://www.ftc.gov/os/2000/07/idtheft.htm 



489 


In her March 7, 2000 testimony before the Subcommittee, Bernstein elaborated 

further: 

A consumer's credit history is frequently scarred, and he or she typically 
must spend numerous hours sometimes over the course of months or even years 
contesting bills and straightening out credit reporting errors. In the interim, the 
consumer victim may be denied loans, mortgages, a driver's license, and 
employment; a bad credit report may even prevent him or her from something as 
simple as opening up a new bank account at a time when other accounts are 
tainted and a new account is essential. Moreover, even after the initial fraudulent 
bills are resolved, new fraudulent charges may continue to appear, requiring 
ongoing vigilance and effort by the victimized consumer." . . , 

Identity theft victims continue to face numerous obstacles to resolving the 
credit problems that frequently result from identity' theft. For example, many 
consumers must contact and re-contact creditors, credit bureaus, and debt 
collectors, often with frustrating results." 
http://w*ww.ftc.aov/os/2000/03/identi tvtheft.htm 

The General Accounting Office wrote in one of if its first reports on identity theft 
in 1998: 


"Identity theft can cause substantial harm to the lives of individual citizens 
- potentially severe emotional or other non-monetary harm, as well as economic 
harm. Even though financial institutions may not hold victims liable for 
fraudulent debts, victims nonetheless often feel 'personally violated' and have 
reported spending significant amounts of time trying to resolve tire problems 
caused by identity theft - problems such as bounced checks, loan denials, credit 
card application rejections, and debt collection harassment," it wrote. (GAO-02- 
424T, Identity Theft: Available Data Indicate Growth in Prevalence cfe Cost 
( www.gao.gov/new.items/d0242t.pdf ) 

Whaf s at stake here is nothing less than the good name of every American who 
participates in the economy. The view that one's good name is of paramount importance 
is supported by FTC complaint statistics. In 1993, the U.S. Public Interest Research 
Group (USPIRG) issued a report based upon a Freedom of Information Act request to the 
FTC, which showed that inaccuracies in credit reports was the leading cause of consumer 
complaints to the FTC. This category led all others, including categories that include out- 
of-pocket losses. 

1. Credit bureaus (30,901); 

2. Misc. Credit (22, 729); 

3. Investment Fraud (12,809); 

4. Equal Credit Oppt. ( 1 1 ,634); 

5. Automobiles (6,901); 

6. Truth-In-Lending (6,303); 
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7. Household Supplies (5,835); 

8. Recreational Goods (5,747); 

9. Mail Order (4,687) 

10. Food/Beverage (2,738). 

Ten years later, FTC complaint statistics confirm that consumers care most about 
protecting their good name, well above other categories involving out of pocket losses. 
For three years running, identity theft is the leading cause of complaints to the FTC, 
These are the numbers from the FTC’s January 23, 2002 release 

1. Identity Theft (42%); 

2. Internet Auctions (10%) 

3. Internet Services and Computer Complaints (7%) 

4. Shop-at-Home and Catalog Offers (6%) 

5. Advance Fee Loans and Credit Protection (5%) 

6. Prizes/Sweepstakes/Gifts (4%) 

7. Business Opportunities and Work at Home Plans (4%) 

8. Foreign Money Offers (4%) 

9. Magazines and Buyers Clubs (3%) 

10. Telephone Pay-Per-Call/Information Services (2%) 

http://www.ftc.gOv/opa/2002/0 1 /idtheft.htm 

This might be surprising to some, but it shouldn’t be. Protecting one's good name 
is so fundamental to mankind that Shakespeare wrote about it some 400 years ago. 

Who Steals My Purse steals trash: 'Tis something, nothing; 

Twas mine 'tis his and has been slave to thousands. 

But he that filches from me my good name 
Robs me of that which not enriches him. 

And makes me poor indeed. 


This Committee deserves credit for hearing directly from victims of inaccttrate credit 
reports. The witnesses from whom you have heard represent the unfortunate experiences of 
thousands upon thousands of consumers over the past decade. I am sure that the Committee 
Members agree that hearing directly from these victims has given them a fuller appreciation of 
how profoundly damaging these problems are, and why stronger measures are needed to prevent 
them. 


Unfortunately, there are too many companies within the financial services industry that 
do not consider it all that damaging to be the victim of an inaccurate credit report. In several 
cases in which consumer have clearly demonstrated mistakes and negligence by CRAs or credit 
grantors, the CRAs and credit grantors typically will argue that the consumer was not really 
damaged by the ordeal of cleaning up a polluted credit report. 
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This attitude is in sharp contrast to the Committee Members and members of the public 
who have stated unequivocally that credit report inaccuracy can be extremely damaging and can 
even ruin one’s life. 

Therefore, to advance understanding about the damaging nature of credit report 
inaccuracy, the following reiterates some of the typical categories of damage, and then provides 
a formula for gauging those damages. This categorization and formula were submitted to and 
presented at the FTC’s June 18, 2003 Workshop, “Information Flows: The Costs & Benefits to 
Consumers and Businesses of Collection and Use of Consumer Information.’’ 

Some Categories of Typical Damages/Costs of ID Theft & Inaccuracy 

• (1) Inaccurately described as deadbeat to third parties 

• (2) Improperly denied credit because of inaccurate information 

• (3) Expended time and energy to correct errors not of one’s making 

• (4) Wrongfully received debt collection calls 

• (5) Chilled from applying for credit 

• (6) Sleeplessness, physical symptoms 

• (7) Sense of helplessness, loss of control over personal data 

• (8) The emotional distress stemming from, and associated, with all of the above 


I propose a formula that takes into account the following factors. 

FACTORS 

1 ) The nature and substance of the above described category' of damage 

2) Time & energy to solve the immediate problem 

3) The expectation that the problem was solved 

4) The number of recurrences 

5) The period of time over which the problem persists 

In essence, the formula would need to “assign weights or points ’’ to each factor 
and then multiply Factor (1) by Factor (2); then that result would be multiplied by Factor (3), and 
then by Factor (4), etc. The purpose is to measure the compounding nature of the damage. 

As a preliminary example, take the “Category 1” — inaccurate characterization. Let’s say 
John Doe, a victim of identity theft, discovers in January 2001 that his credit report was polluted 
with highly negative collection and charge-off accounts generated by a fraudster. This would be 
a momentous event, deser\'ing a significant assignment of points under the formula. After all, 
the inaccurate credit report was not the result of anything done by John Doe and was totally 
unexpected, so the “shock value” (Category #8, emotional distress) was relatively high. Rather 
than routinely extending him credit, the system falsely branded him unworthy of credit. Further 
points are assigned because this inaccurate characterization coincided with the mijust denial of 
credit (Category #2). It’s possible that this unjust denial resulted in being humiliated in front of a 
store clerk or friends (Category #8), and wdth being unable to do anything about it (Category #7). 
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Thus, the formula assigns a relatively large number of damage points for John Doe’s first 
interaction under Factor #1 , as compared to a consumer who only finds a few minor inaccuracies 
on his credit report that did not result in a denial of credit, humiliation and sense of helplessness. 

If John Doe’s credit report worsens because of the addition of an imposter-caused 
bankruptcy. Category 1 later earns additional points. The other multipliers come into play, as 
John Doe must expend time and energy to solve the problems (Factor 2), and although he 
develops an expectation that the problem is solved (Factor 3), he later learns of recurrences of 
being mischaracterized (Factor 4) and the problem persists over a defined period of time 
(Factor 5), 

It seems logical that since we are relying so heavily on credit scores to summarize a 
consumer’s creditworthiness, we also should have a scoring model for measuring the damages 
and costs to consumer caused by defects in the national credit reporting system. Perhaps such a 
scoring model would finally help the financial services industry appreciate the extremely 
damaging nature of credit report inaccuracy. 

As Judge M. Blane Michael pointed out in his dissent in Doe v. Chao , a 4‘'' Circuit 
Privacy Act case in which the U.S. Supreme Court granted certiorari, privacy statutes need to 
accommodate the special nature of damages that result from invasion of privacy. In his dissent, 
he said a detailed showing wasn’t necessary because the Privacy Act “plainly awards $1,000 in 
statutory damages to a plaintiff who can prove $ 1 , or even one penny, of actual damages." He 
explained why: "First, Congress created the statutory damages remedy as an incentive to suit 
because it recognized that damages from government invasions of privacy are hard to prove. 
Second, Congress recognized that the typical injury caused by the invasion of privacy is 
emotional distress.” 

I am including my method for assessing and gauging damages in this testimony to 
facilitate and accelerate its dissemination to industry, regulators, attorneys and consumer groups. 
1 very much welcome feedback from all quarters, as 1 intend to improve the formula upon 
receiving constructive suggestions. 


The Exemption Provisions 

There has been a lot of discussion about the need to reauthorize the FCRA preemption 
provisions in order to maintain uniform national standards. But in at lea,st in three crucial areas, 
the preemption provisions either do not set any real national standard or set ones that are so weak 
and ineffective that they need to be significantly strengthened. Moreover, consumer protection 
would be advanced by freeing up the States to protect their citizens in these areas, particularly if 
Congress is unable to enact a sufficiently strong national standard. 

Duties On Furnishers 


As a political compromise. Congress in 1996 created a multi-tier system that places only 
a minimal duty on furnishers to report information accurately to credit bureaus. The first 
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national standard (1681s-2(A)) merely requires that creditors not furnish information that they 
know or consciously avoid knowing is inaccurate. This standard is extremely weak; the 
American people deserve better. If there is non-compliance with this provision, even after the 
consumer notifies the credit grantor of the reporting errors, then the only entities that can take 
enforcement actions are the federal or state agencies with jurisdiction. To my knowledge, there 
have been no enforcement actions under this section. 

Individuals only have the right to enforce their own rights under the second national 
standard (1681s-2(B)) after: (1) they dispute the credit grantors’ errors with the CRA, (2) the 
CRA communicates that dispute to the credit grantor, and . (3) the credit grantor reports the 
disputed inaccurate information again. 

In my opinion, these FCRA “national standards” contribute to inaccuracy because they 
give credit grantors much too much leeway to engage in sloppy reporting practices. In practice, 
they have proven to be ineffective. They create too many hoops for consumer to jump through in 
order to facilitate simple correction of errors. For instance, if the consumer is not aware that he 
must dispute a credit grantor error with the CRA, then he cannot get enforcement unless some 
Federal agency like the OCC is willing to go to bat for him. (You can bet that won’t happen.) If 
he does report it to the CRA and the problem continues, some consumers have found it difficult 
to prove that the CRA relayed the dispute to the credit grantor. Even when consumers have 
satisfied these requirements, leading credit grantors, like Sears and MBNA, have argued that 
S-2(b) doesn’t give consumers the right to sue. As Leonard Bennett testified before the House, 
MBNA argues that there is no national standard. I disagree with MBNA on this point, but it is 
clear that the standard is not sufficient to protect consumers’ privacy and promote healthy 
accuracy throughout the national credit reporting system. 

At a minimum. Congress should simply extend to credit grantors the FRCA 
reinvestigation requirements that currently apply to CRAs. However, if the Congress is unable 
to bolster protections for consumers in this area, it should leave the States free to do so. 

Some industry officials, or the “researchers” they underwrite, put forth the argument that 
credit grantors will stop furnishing information if the law poses to strong a duty to report 
accurately. This argument is specious. In my opinion, credit grantors will not stop reporting 
negative information because they view the credit reporting system as an ann of debt collection. 
To an extent, that is the way the system should work. Smart consumers pay their bills on time so 
as to avoid having late payments go on their credit histories. Thus, credit grantors have a very 
systematic incentive to continue reporting data to credit bureaus. Unfortunately, I have seen 
cases in which credit grantors were so anxious to collect unpaid debts that they continued to 
report them well after they were notified that the debts were caused by an imposter, but were 
going onto the credit report of the innocent victim. 

In addition, the only current evidence of partial reporting is by credit grantors like Capital 
One and others who purposely don’t report their customers’ credit limits so as to make them look 
less appealing to the pre-screening process. Capital One has said explicitly that it only reports 
partially for competitive reasons, i.e., customer retention. The Committee should investigate 
how widespread this practice is. 
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Pre-Screening 

Another national standard, relating to pre-screening, requires senders of so-called pre- 
approved credit or insurance offers to “provide with each written solicitation ... a clear and 
conspicuous statement that” the CRA was the source of the information and that the consumer 
can opt out. As confirmed by the piles of pre-approved credit offers that most of us receive via 
the mail, most of the notices in reality are neither clear nor conspicuous. In his testimony last 
week, U.S. PIRG’s Ed Mierzwinski included a typical opt-out notice in his testimony. Most of 
the notices feature the kind of fine print that consumers typically ignore, mimic the language 
from the statute itself, and would not score high in readability te.sts. They usually include sub- 
heads that would not attract the reader’s eye, like, “Notice Regarding Pre-Screened Offer,” or 
Terms of Pre-Approved Offer,” or Fair Credit Reporting Act Notice.” 

In other words, these are “notices” that are designed not to be noticed. The first line 
typically advises that “information in your credit report was used in connection with this offer,” 
and “you received this offer because you satisfied the criteria for creditworthiness used to select 
you for this offer.” The next line finally informs you that you’re not really pre-approved in the 
way you might think: “Grant of this offer, after you respond to it, is conditioned upon your 
satisfying the creditworthiness criteria used to select you for the offer.” By the fourth line, the 
notices advise, “You have the right to prohibit use of information in your file with any credit 
reporting agency in connection with any transaction that you do not initiate.” If the reader gets 
through all that, he can finally find the address to write the three CRAs or the number to call 
(888) 567-8688. 

In my opinion, the vast majority of Americans, despite regularly receiving pre-screened 
offers, are not aware that these offers are generated from their credit report. Now we know that 
there is a heightened urgency in making Americans aware. 

In the June 16, 2003 issue (Vol. 23 No. 12), Privacy Times broke a major investigative 
news story about how various criminal gangs across the nation, intent on committing identity 
theft and credit fraud, are targeting mail boxes for consumers’ personal information and financial 
instruments. Their favorite targets include “convenience checks,” pre-approved credit card 
offers and bank statements. The gangs involved with these have demonstrated different levels of 
sophistication. Some consist of drug addicts; others are associated with specific foreign 
nationals. Some of the more active gangs hit 200-300 mailboxes in one day. Some of the gangs 
try and use convenience checks or pre-approved credit card offers to get credit quickly. Others 
sell the personal data to other gangs specializing in identity theft, credit fraud and counterfeiting. 

Since October 2002, postal inspectors have made 2,264 identity theft-related arrests 
stemming from mail theft investigations. In one recent month in one mid-sized western city, 
there were 20 aiTests and 14 prosecutions. In that city, one law enforcement team has four of its 
six investigators dedicated to identity theft. (See “Attachment 1 ”) 

Like everything related to identity theft, the raiding of mailboxes by ID theft gangs 
promises to get w'orse. Therefore it is imperative that we strengthen the rights of Americans to 



495 


have reasonable control over their identifying infonnation and sensitive financial data so they 
can protect themselves against identity thieves. This means not only strengthening consumers’ 
rights to know about and stop the use of their data for pre-screening, but also blocking use of 
their personal data for other financial offers that might not be made from affiliate-sharing or 
other process that falls outside of the FCRA-reguIated pre-screening. I agree with U.S. PIRG 
that the solution to this problem is a national “Do Not Send Credit Offers” Registry, similar to 
the “Do-Not-Call” Registry being developed by the FTC. 

Pre-screening clearly played an important role in the past decade’s credit boom. But we 
have to recognize that times are changing, that we need to be forward looking and “not fighting 
the last war.” The above-described threat from criminal gangs should cause us to examine 
critically the costs and benefits of pre-screening. Moreover, in today’s hyper-competitive credit 
markets, consumers have an array of choices and ways they can find the best credit offers when 
they so choose, including radio and print ads, the Internet and the telephone. 

Affiliate Sharing 

“No requirement or prohibition may be imposed under the laws of any State ... (2) witli 
respect to the exchange of information among persons affiliated by common ownership or 
common corporate control.” Thus, the FCRA’s provision on affiliate-sharing does not set a 
national standard, it simply bars State action. In effect, the provision says there shall be no 
standard . 

Because the provision was added hastily in 1996 with no hearings or analysis, it is poorly 
crafted and confusing. The financial services industry has argued that the provision bars 
California or its localities from enacting provisions that would strengthen consumers’ rights to 
opt-out from affiliate sharing of financial data not covered by the FCRA. 

This is a rather bizarre situation, because Gramm-Leach-Bliley also does not set a 
national standard on affiliate sharing - it only provides notice and opt-out for sharing with third 
parties. In GLB, Congress recognized that affiliate sharing implicated important privacy issues 
and specifically added the Sarbanes Amendment, preserving the rights of the States to enact 
stronger financial privacy laws, including ones that gave consumers rights in relation to affiliate 
sharing. 

The GLB notice-and-opt out standard has proven ineffective. The notices generated 
under the law are confusing to consumers and costly to industry. Last year, the people of North 
Dakota voted 72% in favor of restoring an opt-in financial privacy law. If the California 
legislature fails to pass Sen. Jackie Speier’s legislation (SB 1 , an opt-in for third parties, opt- out 
for most affiliates), then Californians will vote an even .stronger initiative in March 2004. 
Opinion polls show that 85-90% of Californians favor an opt-in standard for their sensitive 
financial data. 

This should come as no surprise. I would urge members of this committee, when 
opportunity arises, to ask constituents two straightforward questions: “Should banks have to get 
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your permission before they sell or share your financial data with outsiders? Should you have 
any rights to stop companies from sharing your financial data among affiliates?” 

Congress has the opportunity to correct the mistakes of GLB, which is not based upon 
traditional Fair Information Practices standards, and expand the protections of the FCRA to all 
sensitive financial data. The American people want this. If Congress is unable to accomplish 
this, the States must be left free to protect their citizens. 

In my opinion, problems in the current system are too far-reaching for Congress to come 
with thoughtful, workable legislative solutions in less than six months. After all, it took six years 
to enact the 1996 amendments. To advance the legislative debate. I’ve attached the following 
list of preliminary concepts for improving the law. 


Preliminary Concepts For Improving The FCRA/National Financial Privacy Law 

The following are some of the preliminary concepts are vital to updating the FCRA and 
national financial privacy laws. This list is the work of several groups and experts, including 
U.S. PIRG, Consumers Union. Consumer Federation of America, National Association of 
Consiuner Advocates, National Consumer Law Center and myself. 

BRIEF SUMMARY OF IMPROVEMENTS FOR FCRA. FINANCIAL PRIVACY 

1) Strengthen, Promote Consumer Access To Credit Reports 

A. One Free report per year w/ Credit Score (Explained) 

B. Cap price of monitoring/alert services 

(Accuracy & ID Theft Benefits) 

C. Require credit grantor to provide credit report that caused adverse action 

2) Improve Accuracy 

A. Strengthen Duty On Furnishers To Report Accurately & Reinvestigate 
Disputes - 

B. Require that furnishers who report, abide by a “completeness” standard 

C. Notify consumers when negative info reported 

D. Shorten reinvestigation period 

3) Identity Theft 

A. Match four identifiers before disclosing credit report 

B. Fraud Flag Alert 

C. Address Change verification 

D. Get the SSN out of circulation (Anti-Coercion, Credit Headers) 

4) Strengthen Consumer Rights Over Pre-Screening 

A, Notice prescribe by statute, prominence requirement 

B. Have a National Opt Out Registry for All Credit Card Offers 
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5) Affiliate-Sharing Privacy - 

A. Enact Shelby-Markey opt-in, opt-out for third party & affiliate-sharing 

B. Extend access/correction rights to all financial data 

6) ‘Demooratize/Popularize’ Enforcement 

A. Minimum statutory damages 

B. ‘Catalyst theory’ for attorneys fees 

C. Express consumer right to File In Small Claims Court (Like TCP A) 

7) Add Injunctive Relief 

8) Ban Use of Credit Scores in Insurance 

9) Eliminate State Preemption 

What’s Wrong With The House Bill 

This statement is being written in advance of the July 9'*' legislative hearing of the House 
Financial Services Committee. At that hearing, I expect the Consumer Federation of America 
and the Electronic Privacy Information Center to provide a detailed critique of HR 2622. 1 also 
expect that I will support most, if not all, of the criticisms and recommendations made by those 
two organizations. 

This will serve as a preliminary response. On credit reporting issues alone, HR 2622 is 
woefully inadequate. First of all, due to its incomplete approach, it will fail miserably at 
achieving its primary goal of curbing identity theft. Second, it virtually ignores the remaining 
75 percent of the problem, namely, credit report inaccuracy caused by the routine practices of 
both CRAs and credit grantors and the Act’s weak enforcement provisions. 

According to only a preliminary assessment, it appears the best provisions in HR 2622 
relate to free credit reports and fraud alerts. These provisions in part came from legislation 
introduced by Congresswoman Darlene Hooley and others several years ago. Of course, identity 
theft has worsened dramatically since the Hooley bill was first introduced. So even on the 
identity theft issue, if these provisions are the only proposed solutions, then HR 2622 is already 
behind the times. If HR 2622 did not propose to preempt State law, then the best that could be 
said about it is that it’s a “Nice Little Bill.” 

The problem is that identity theft is not a “Nice Little Problem.” It’s considered the 
fastest growing white-collar crime in the United States. Nor is credit report inaccuracy, 
unrelated to identity theft, a “Nice Little Problem.” All evidence indicates that it has persisted as 
significant problem for at least 1 3 years, that it can be extremely damaging to consumers, and 
that CRAs and credit grantors have not adequately upgraded their procedures to address the 
problem. Moreover, in today’s environment of “risk-based pricing,” and monthly “account 
reviews” of credit reports by credit card companies, and widespread reliance on credit scores by 
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insurers, a consumer’s credit report is the crucial determinant of whether that consumer will 
obtain credit or insurance, or on what terms 

If HR 2622 is the best Congress can do, it will represent a sadly missed opportunity of 
enormous proportions. It will fail to turn the tide in the fight against identity theft, and by its 
omissions, it will fail to effectuate changes in financial services industry practices that are 
necessary to combat inaccuracy. In sum, it threatens to leave in place the glaring defects in the 
current system. It will confirm fears that Congress simply is not capable of establishing an 
adequate national standard for consumer privacy. Worse of all, it could stop the States from 
making much needed improvements in such areas as duties on furnishers, pre-screening and 
affiliate-sharing, 

HR 2622: 

• Fails to cap the price of credit report monitoring and alert services 

• Fails to strengthen the duties on furnishers to report accurate information and conduct 
adequate reinvestigations 

• Fails to address routine CRA practices that contribute to inaccuracy, including 
“partial matches,” sy.stematic failure to forward all relevant consumer dispute 
information to the credit grantor, and failure to conduct adequate audits to ensure data 
integrity. 

• Fails to strengthen consumer enforcement authority and remedies 

• Fails to provide much-needed protections for SSNs 

• Fails to address pre-screening or create a National Regi.stry that will allow comsumers 
to opt-out from receiving all financial offers in the mail 

• Fails to address the FCRA’s problematic affiliate-sharing provision 

• Fails to cure GLB by strengthening consumers’ rights in relation to sensitive financial 
data not covered by FCRA. 

• Fails to address insurers’ use of credit scores 

In my opinion, these are the changes that are necessary to turn the tide against identity 
theft and to put us on the road to improving credit report accuracy. 


The Federal Trade Commission 


Throughout the 1990s, the FTC played an important and historic role in fighting for 
consumers on several credit reporting issues. Along with the State Attorneys General, the FTC 
brought enforcement actions that resulted in Equifax, Trans Union and TRW promising to adhere 
to a higher standard of care in handling consumer data. In the six years that Congress considered 
the Amendments to the FCRA, the FTC steadily provided valuable expertise and input. The 
FTC brought two lawsuits against Trans Union, successfully enforcing important privacy 
standards in FCRA and GLB. It also promulgated regulations under GLB that were designed to 
enhance safeguards for consumer privacy. It brought a separate enforcement action against the 
three major CRAs, resulting in an agreement that, when consumers called statutorily-mandate 
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toll free number, the CRAs would answer the phones. FTC staff turned out several important 
opinion letters during the decade as well. 

In contrast, in the past two years, while the FTC has worked hard on junk phone calls, 
spam and non-FCRA enforcement actions, in the area of FCRA, during this crucial period in the 
Act’s history', the FTC seems to have gone into hiding. While last year it completed an 
enforcement action against a furnisher and another against a user of credit reports, it appears that 
the FTC has lost its appetite for going after the kinds of systematic problems, involving major 
players, that it did a decade ago. (Perhaps 1 will be corrected by today’s testimony.) 

Moreover, at this crucial point in history, when Congress has been formulating legislative 
responses to the expiration of the preemption provisions, the FTC has been silent. It apparently 
has abandoned its previous role of identifying ways to advance the FCRA’s consumer protection, 
or to respond to the ideas of others. It couldn’t even take a position on the issue of “one free 
credit report per year.” What’s up with that? 

Also troubling were some of the personal comments of FTC Consumer Protection Chief 
Howard Beales before this Committee and its counterpart in the House. Beales said that CRAs 
were both victims and/or targets of identity thieves, and represented a “solution” to identity theft. 
While this statement might be technically correct, it is shockingly silent on the important issue 
that his predecessor, Jodie Bernstein raised: That one of the main damages to consumers arising 
from identity theft is the problem of getting the CRAs to correct imposter-generated errors and 
prevent their reinsertion in the report or their dissemination to others (see Pages 7-8 of this 
testimony). 

If it is true that the FTC is departing from its traditional role of being a vigorous advocate 
for consumers in the area of credit reporting, then Congress will need to address this. In so 
doing, it should examine the approach taken by every other major Western nation: Creation of A 
National Office of Privacy Commissioner. Either way, consumers need an ombudsman to 
counter CRA and credit grantor recalcitrance and help them get inaccuracies corrected. The 
FCRA should create such an ombudsman. 


Some Judges Appear Hostile To Consumers Enforcing Their FCRA Rights 

There is some good FCRA case law, especially among some of the Circuit Courts. 
However, some key issues have not fully been settled. 

In addition, there are some district judges that appear outright hostile to the FCRA or 
consumers seeking to enforce their rights under the Act. 

For example, in the Andrews case, which ultimately went all the way to the U.S. 

Supreme Court over the issue of the 2-year discoveiy rule. Judge Lourdes Baird used some 
creative legal reasoning in finding that the credit bureau did nothing wrong when it disclosed the 
credit report of the innocent victim in response to a credit application by the identity thief. 
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The FCRA allows disclosure to a person which it has reason to believe “intends to use the 
information in connection with a credit transaction involving the consumer. . . “ 

Judge Baird wrote: “The consumer is ‘involved’ in the transaction, because the imposter 
is puiporting to be the consumer. Although in a strictly technical sense, the transaction does not 
involve the ‘extension of credit to . , . the consumer .’ the Court finds this not to be dispositive.” 

“The Court finds as a matter of law that disclosing a consumer’s credit report in response 
to a credit application by an imposter impersonating the consumer by use of consumer’s 
identifying information is a disclosure for a permissible purpose under the FCRA,” Judge Baird 
wrote. .Tudge Baird also refused to allow' admission of evidence that showed the growing 
prevalence of identity theft. (Andrews r. Trans Union Corp., 7 F. Supp. 2d 1056, 1066-1067 
(CD Cal. 1998)) 

This 1998 opinion would have set an ominous standard as identity theft was dramatically 
worsening. Fortunately, the U.S. Court of Appeals for the Ninth Circuit reversed, w'riting, 

'"Involve' has two dictionary' meanings that are relevant: (1) 'to draw in as a 
participant' or (2) 'to oblige to become associated.' The district court understood the word 
in the second sense. We are reluctant to conclude that Congress meant to harness any 
consumer to any transaction where any crook chose to use his or her number. The first 
meaning of the statutory term must be preferred here. In that sense the Plaintiff was not 
involved," wrote Judge John T. Noonan. He was joined by Judges William Canby Jr. and 
William A. Fletcher. (225 F. 3d 1063, 1066 (2000)) 

"As the district court observed, there are 250 million persons in the United States 
(not all of them having Social Security numbers) and 1 billion possibilities as to what any 
one Social Security number may be. The random chance of anyone matching a name to a 
number is very small. If TRW could assume that only such chance matching would 
occur, it was reasonable as a matter of law in releasing the Plaintiffs file when an 
application matched her last name and the number. But we do not live in a world in 
which such matches are made only by chance." 

"We take judicial notice that in many ways persons are required to make their 
SSNs available so that they are no longer private or confidential but open to scrutiny and 
copying. Not least of these ways is on applications for credit, as TRW had reason to 
know. In a world where names are disseminated with the numbers attached and dishonest 
persons exist, the matching of a name to a number is not a random matter. It is 
quintessentially a job for a jury to decide whether identity theft has been common enough 
for it to be reasonable for a credit reporting agency to disclose credit information merely 
because a last name matches a SSN on file," the court said. 

In Carney v. Experian . (57 F. Supp. 2d 496 (W.D. Tenn. 1 999)), U.S. Magistrate .Tudge 
Diane K. Vescovo appeared to totally disregard Sect. 1681 (s)(2)(b) in ruling that the FC RA did 
not create a private right of action against furnishers who continue to report inaccurate data after 
the consumer’s dispute is sent to them by the CRA. New Haven, Conn. Attorney Joanne 
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Faulkner wrote to Magistrate Vescovo, attaching an FTC opinion letter indicating that she 
grossly misread that the statute. In suggesting that she either correct or withdraw that part of her 
opinion, Faulkner wrote, “While the oversight seems minor, it could cause significant litigation.” 
Magistrate Vescovo never responded. Indeed, several financial institutions have cited Carney in 
arguing that they can’t be sued for repeatedly reporting inaccurate data after being notified by the 
CRA. Most courts have rejected their arguments and ruled that S2-b does create a private right 
of action. 

In his February 7, 2002 opinion in Richard Sheffer v. Experian Information Solutions, 
etaL . Judge Berle Schiller , of the Eastern District of Pennsylvania, rejected Sears’ argument 
that FCRA Sect. “s-2(b)” did not create a private right of action against the “furnishers.” (Slip 
Op. No. 02-7407) 

Judge Schiller agreed with other courts that it was “obvious” that Congress intended to 
allow consumers to sue creditors who failed to stop reporting inaccurate data after the consumer 
disputed the information with the credit bureau. He noted the New Mexico court’s view that the 
Carney conclusion to the contrary was “baffling.” 

Another problem is that some federal judges do not w'ant to sit through FCRA trials, 
effectively depriving consumers of their day in court or significantly interfering with the right. 

In one case, a woman had endured inaccuracies caused by Equifax for some 1 5 years. She had 
patiently waited for her day in court. But tlie Judge intensely pressured the woman and her 
lawyers into settle the case, effectively preventing them from presenting evidence that they 
thought would support an award of punitive damages. 

In another case, the plaintiff again were intent on going to trial, as there was a large gap 
between the two sides as to the extent of the damages. But the judge made several phone calls 
and warned plaintiffs and defendants that there could be consequences for not settling the case. 

Attorneys tell me that these sort of things are regular occurrences. Nonetheless, it is 
troubling although the statute gives consumers a right to go to court, some judges don’t think 
FCRA rights are important enough to honor. There are several examples of judges indicating 
that they do not believe FCRA cases are worthy of being in their courtrooms. This not only 
deprives consumers of an avenue of enforcement tliey are supposed to have, it also encourages 
recalcitrance and hardball litigation tactics on the part of CRAs and credit grantors. 

The FCRA statement and purposes section already says that CRAs have “assumed a vital 
role in assembling and evaluating consumer credit and other information on consumers,” and, 
that “There is a need to ensure that CRAs exercise their 

grave responsibilities with fairness, impartiality, and a respect for the consumer’s right to 
privacy.” [Emphasis added] In my opinion, that should have been sufficient to convince all 
judges to take seriously FCRA violations and the damages they cause consumers. 

But that hasn’t been the case. Thus, Congress must be more explicit, so as to make it 
crystal clear to the judiciary, that court enforcement of FCRA standards, and recognition of the 
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damaging nature of credit report inaccuracy, is vital to fairness, accuracy and privacy in credit 
reporting system. 


Attachment 1 


Page 2 PRIVACY TIMES/June 16. 2003 

CRIMINAL GANGS HITTING MAILBOXES 
FOR CREDIT OFFERS. PERSONAL DATA 

Criminal gangs of varying size and sophistication around the country are making identity 
theft their crime of choice, and mail theft their primary' method of operation, a Privacy Times 
investigation has discovered. 

The criminals are on the prowl for pre-approved credit card offers, “convenience checks” 
bank and insurance statements - anything that will allow them to convert other people’s data into 
cash or credit, according to Postal inspectors. 

Phil Bartlett, the U.S. Postal Inspection’s manager for external crimes and identity theft, 
and Robert Maes, the Phoenix area U.S. Postal Inspector and public relations officer, agreed with 
the view that identity theft is the fastest-growing crime in the United States. 

“Twenty years ago the criminals to robbed banks and risked serious jail time,” Maes said. 
“Now, even if they get caught (at ID theft), they’re usually looking at six months. Their not 
considered dangerous and they keep themselves under the radar screen. But they’re wreaking 
havoc on financial institutions and individuals.” 

Bartlett said that in the past seven months, postal inspectors have made 2,264 identity theft- 
related arrests. He said a variety of methods are used to nab perpetrators, including surveillance, 
interviews of arrestees and linkage of cases. 
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“Some thieves will steal a pre-approved app, send it in, and either change the address or 
come back to take tlie credit card out of the mail box. Others will get checks, call the bank and try 
to change the customer’s address,” Bartlett said. 

Dennis Fernald, who heads the 6-member Postal Inspection team in Portland, Oregon, said 
that four of his inspectors are working identity theft cases full-time. He said that some gangs hit 
up to 200-300 mailboxes a day. 

“They like convenience checks, because it offers them the best chance for instant cash. 
Some of them can ‘wash’ checks and then change the name. Many just sell any personal informa- 
tion they can find to gangs that specialize in counterfeiting and identity theft,” Fernald said. 

Some gangs are made up of drug addicts; others consist of foreign nationals, including 
Nigerians, Lithuanians, Russians, Asians or Middle Easterners, Fernald said. Others are made up 
of Gay “cross-dressers,” with names like “Flouse of Con” and “House of Ebony,” Bartlett said. 

In May alone, Fernald said his team made 20 arrests, resulting in 14 prosecutions. He 
praised the U.S. Attorney’s office in Portland for taking the issue seriously and getting criminals 
off the streets. 

Maes said the primary perpetrators in the Phoenix area are loosely-knit “circles” of “Meth- 
Amphetamine” drug addicts, sometimes referred to as “Tweakers.” Hitting mailboxes for personal 
data and financial instruments fits their vagrant lifestyle, he added. 

PRIVACY TIMES/June 16. 2003 Pace 3 

“They have their own terminology. They don't work, they live in hotel rooms and stolen 
vehicles; they keep late hours. They love to gamble. Wlien arrested, they usually don’t have much 
because they’ve blown all their money,” Maes said. 

Maes said unless associated with groups like the Aryan Brotherhood (a White supremacist 
outfit), the “Meth” addicts usually aren’t that organized. “Someone will know' someone who will 
trade drugs for Social Security numbers. Sometimes they can get cash for convenience checks or 
personal information,” he said, 

“In the old days, they would wash checks with Acetone. Now, they go to a guy with a 
computer who uses (off-the-shelf) check-making software like VersaCheck,” he said. 

Since October 1, Maes, who heads a 10-member team, said there have been 45 arrests of 
mail thieves on federal charges, and 72 on State charges. From Oct. 2001-2002, there were 129 
arrests on federal charges, and 1 30 on State charges. From Oct. 2000-2001, 88 on federal charges, 

1 1 0 on State charges; from Oct. 1 999-2000, 69 on federal charges. 74 on State charges. 

A Postal inspector in a mid-sized, Midwestern city, said in his area, “Meth” addicts were 
behind 80% of mail theft. “When we arrest one, he’s usually willing to give up someone he knows 
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who is doing the same thing. But thej'’re hard to track down because many of them live out of 
cars,” he said. 

In the Phoenix area, the problem was compounded by the installation of 47,000 “cluster” 
mailboxes in housing developments. The convenience for the mail carrier of having a 
neighborhood’s mailboxes in one spot quickly proved convenient for identity thieves. Maes said 
the Postal Service is retrofitting the boxes. On June 17, the Postal Service plans to unveil in 
Phoenix a secure, lockable mailbox. 

Of course, mail theft is only one of many techniques used by identity thieves. Bartlett said 
that stealing from the garbage ~ even at post offices - is common. “That’s why we advise people 
to shred their pre-approved apps and other forms containing personal data,” he said. 

Increasingly, Bartlett continued, the more sophisticated gangs are bribing employees with 
access to personnel records and other data in order to obtain the information they need to commit 
identity theft. 

The Postal Service’s Web site advises people to promptly remove mail after delivery, 
deposit outgoing mail in one of the Service’s blue collection boxes, slired pre-approved credit 
applications and other financial documents before discarding them, order credit reports every year, 
and avoid giving personal data over the telephone or Internet to unknown parties. 
www.usps.com/Dostalinsoectoi's/idthft ncnw.htm & www.usDs.comyDOStalinspectors/lDtheft2.htm 

Bartlett said later this summer, the Postal Service, in conjunction with the Financial 
Industry Mail Security Initiative (FIMSI). will launch a consumer awareness campaign on mail 
and identity theft. FIMSI includes representatives from federal and local agencies and industry. 
Bartlett said that industry is doing a better of job of “sanitizing” mailings so they don’t contain 
sensitive personal information. 


Attachment 2 


Carol Fleischer Mixed With Carolyn Cassidy 
Ann Arbor, MI Highland, MI 

1 -Digit Difference In SSN 


Judy Thomas Mixed With Judith Upton 
Klamath Falls, OR Stevens, WA 

1 -Digit Difference In SSN 
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Jason Turner Mixed With Jason Turner 
Birmingham, AL Clarmont, FL 

Year of Birth: 1982 Year of Birth 1974 

2-Digit Difference In SSN 

Myra Coleman Mixed With Maria Gaytan 
Itta Bena, Miss. Madera, Calif 

Same SSN 
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RESPONSE TO WRITTEN QUESTIONS OF SENATOR SUNUNU 
FROM TIMOTHY J. MURIS 

Q.l. Currently, consumers can get access to a free credit report if 
they are denied credit. What is the percentage of consumers that 
have been denied credit who actually take advantage of the oppor- 
tunity for a free report? 

A.l. There are tens of thousands of credit report users who are ob- 
ligated to send notices when taking an adverse action. We do not 
have data on how many consumers receive adverse action notices. 
However, a July 21 , 2003 Report from CRS states that 13.4 million 
consumers each year request a free report following adverse action. 
This represents 88 percent of all annual free file disclosures by 
CRA’s to consumers. 

Q.2. What States currently provide full access to free credit reports 
and what are the take up rates for those States? In other words, 
how many consumers that have not been denied credit take advan- 
tage of their free reports? 

A.2. Massachusetts, Colorado, New Jersey, Georgia, Maryland, and 
Vermont require access to free reports. (Some other States require 
access to reports for less than the $9 Federal maximum.) We have 
heard varying reports on the take-up rate in the free States. The 
July 21, 2003 CRS Report states that it is 2 to 4 times the take- 
up rate in States where consumers must pay $9. CDIA tells us that 
the rate of free reports per capita in the free report States is 218.5 
percent that of the States without a free report requirement. But 
we have no absolute numbers — CDIA’s members are reluctant to 
disclose those numbers to us because they do not want their com- 
petitors to be able to figure out their market share. 

Q.3. Which of the three major credit reporting agencies currently 
provide information about scoring methodology on their credit re- 
ports? Specifically, what information is provided? Do the credit re- 
porting agencies provide this information only on request by the 
consumer, or do they provide it automatically in conjunction with 
a consumer’s credit report? 

A.3. This is a question best addressed to the credit bureaus. Our 
understanding is that non-CRA subsidiaries of the three major na- 
tional credit bureaus sell scores to users of credit reports and also 
sell scores directly to consumers, along with educational material. 
We are told that none of those bureaus provide scores as a routine 
matter, either with a free credit report or a credit report for which 
the consumer paid the $9 statutory charge — that is, there is an 
extra charge for the credit score. In some States (California and 
Colorado), credit bureaus are required to provide scores, but are 
permitted to charge for them. 
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PKWD A .M EBEB 

smm aw): sat 77478-3303 


Itou nted »B tor l^ormtitas ixm your nacord. tt* iafoMmitlon that vm 
m^uemtmS Is Oiomn belmr. It you want anyone alas to haw this Intotmaticai, you 
may mmM ttea this letter. 


Information Wwut Carrent Social security Benefits 
B^faBBli^ OecenOjer 3002, the foil monthly 

flooial asraarity benefit before any deductions is. $ 673.30 

We deduct $50.70 for medical insurance premiums each month. 

fflio regulfsr mtaitlily Social Security payment la ...$ 614.00 

SHe rnnst round down to the idiole dollar.) 

Social Security benefits for a given month are paid the followiBg mcaith. (For 
Kcaaple, Social Security benefits for Haroh are paid in Sprll.) 

lour Soelal Security benefits are paid on or about the second Wednesday of 
each moth. 


Data of Birth information 

Hub date of birth shown on our records is February S, 1936. 


Other Important Information 

MR DA.V10 A JOKINBW IS lilOT DBCBASBD OW ASTlt OF ODR RECORDS . THIS IS CDSRBWT 
BBHBFIT liETTSR OP HIS BBBBPITS. 


Medicare Information 

You are entitled to hospital insurance under Medicare beginning February 
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SOCIM, SECORXry MlfCOilXSTSATXCa! 
SOCIAL SECDRITy HUMBER VERIPICATIC® 


OUR RECORDS IHDXCATE SOCIAL SEOJRl'i'Jf HUMBER MA-V-MB 9 

ASSKSSED TO r^AVXD , AHDRBW , UOEIHEH , • 


YCSOR SOCXAL SECDRITY CARD IS THE OFFICIAL VERIFICATICaff OF YOUR SOCIAL SECURITY 
ITOMBER, THIS PRIHTOUT DOES HOT VERIFY YOUR RIGfflP TO WORK IN THE n W i‘|»Kl^ STJasS, 



Houston. Tei<^ 77074 iiTSS 


Medicaxe information 

You are entitled, to medical insurance under Medicare beginning February 2001. 


Type of Social Security Benefit Information 

You are entitled to montlily retirement benefits. 


If You Have Any Questions 

If you have any questions, you may call us at 1-800-- 772-1213, or call your 
local Social Security office at 713--21S-5S00. We can answer most questions 
over cbe phone. You can also write or visit any Social Security office. Ilie 
office that serves your area is located at: 

SOCIAL SECURITY 
SUITE 500 

7324 SOUTSOfSST FREEWAY 
HOUSTON, TX 77074 

If you do call or visit an office, pleas© have this letter witb you. It will 
help us your questions . 




CONSUMER AWARENESS AND 
UNDERSTANDING OF THE 
CREDIT GRANTING PROCESS 


TUESDAY, JULY 29, 2003 

U.S. Senate, 

Committee on Banking, Housing, and Urban Affairs, 

Washington, DC. 

The Committee met at 10:06 a.m. in room SD-538 of the Dirksen 
Senate Office Building, Senator Richard C. Shelby (Chairman of 
the Committee) presiding. 

OPENING STATEMENT OF CHAIRMAN RICHARD C. SHELBY 

Chairman Shelby. Good morning. I want to thank the witnesses 
for appearing today. 

Over the course of the last few months, the Banking Committee 
has held numerous hearings on various issues relating to the Fair 
Credit Reporting Act. 

We have heard testimony regarding the positive changes which 
have resulted in cheaper and more widely available credit. We have 
also heard from witnesses who have highlighted some of the trou- 
bling practices which occur in today’s marketplace. As a general 
matter, I think a common element deserving our careful consider- 
ation has emerged from our hearing process. 

Regardless of whether we are talking about the positive or nega- 
tive developments in the credit markets, consumer understanding 
of these developments, as well as their awareness of the overall op- 
eration of the credit markets, I believe, is the key. Simply, what 
people know and understand about finances I think truly matters. 

Considering that informed, knowledgeable consumers have the 
best opportunity to take advantage of new credit-related products 
and services and are also best able to reduce the likelihood of fall- 
ing prey to the negative developments, such as identity theft or 
predatory lending. It is very important for this Committee to get 
an understanding as to just how much consumers know and under- 
stand about the general operation of the credit markets. 

Furthermore, as the Fair Credit Reporting Act assigns con- 
sumers significant responsibilities with respect to the content and 
the control of their credit reports, the Committee needs to get a 
better understanding as to the level of consumer knowledge and 
understanding of these specific matters. 

That is the purpose of today’s hearing: Providing Members of this 
Committee an opportunity to examine consumer awareness and un- 
derstanding of financial and credit-related matters, generally, and 
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consumer awareness and understanding of their FCRA rights and 
responsibilities specifically. 

In the end, it is my hope that the record established today will 
help guide the Committee’s FCRA reauthorization effort. I want to 
thank you for coming and appearing today, and we look forward to 
your testimony. 

Senator Sarbanes. 

STATEMENT OF SENATOR PAUL S. SARBANES 

Senator Sarbanes. Thank you, Mr. Chairman, for holding this 
hearing on consumer awareness and understanding of the credit 
granting process. Last year, when I was privileged to chair this 
Committee, we held a series of hearings relating to the issues of 
financial literacy and education. So, I am particularly appreciative 
of the attention you are giving to this matter. 

The credit scoring and reporting system plays a significant role 
in most consumers’ lives. However, consumer awareness and un- 
derstanding of the credit granting process is less than it should be. 
I believe that all consumers should have the knowledge to access 
their credit score, the ability to access their score with ease, and 
the understanding necessary to realize the importance of their 
credit score and the impact it may have on consumer choices they 
seek to make. 

Yesterday, the Consumer Federation of America issued a study 
which found the following: 61 percent of all Americans say their 
knowledge of credit scores is either fair or poor, and this figures in- 
creases to nearly 70 percent among households with incomes under 
$35,000 a year; 75 percent of Americans, 80 percent of those with 
incomes below $35,000, say they do not know what their credit 
score is; and when asked a true or false question as to whether ap- 
plying for a credit card may lower your credit score, only 37 per- 
cent of Americans answered correctly. 

This is indicative that there is a serious need to increase finan- 
cial literacy and education among consumers. Actually, a number 
of Members of the Senate have taken a strong interest in this 
issue, and I particularly want to acknowledge the efforts of Sen- 
ators Stabenow and Enzi, as well as Senators Corzine and Akaka. 
I know that Senators Stabenow and Enzi are actually working on 
a bill right now, as I understand it, and I look forward to working 
closely with them and with you, Mr. Chairman, as well as other 
Members of the Committee. 

Yesterday, I introduced legislation with Senator Corzine, the Fi- 
nancial Literacy and Education Coordination Act, which, if passed, 
would create a more unified and comprehensive framework to im- 
prove the state of financial literacy and education amongst Amer- 
ican consumers. This is a first step. This would be an effort to have 
a coordinating committee within the executive branch of the Gov- 
ernment to address the issues of financial literacy and education. 
We established such a committee with respect to the Trade Pro- 
motion Coordinating Committee, and it has worked quite well and 
brought a significant improvement, we think, in the coordinated ef- 
fort within the executive branch of the Federal Government on 
trade promotion. And I am hopeful we could accomplish the same 
thing with respect to financial literacy and education. 
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I thank the witnesses who are here today. Many of them rep- 
resent agencies and organizations that have long heen actively in- 
volved in efforts to increase financial literacy and education, and 
I look forward to their testimony. 

Thank you very much. 

Chairman Shelby. Thank you. 

Senator Bennett. 

STATEMENT OF SENATOR ROBERT F. BENNETT 

Senator Bennett. Thank you, Mr. Chairman. I recognize that 
this is just one in a series of hearings that you have heen holding 
on this particular issue and this hill, and I congratulate you for the 
thoroughness with which you are examining it. We need to get this 
one right, and the opportunity to mess it up in the name of good 
intentions is very high. 

I remember as a brand new Member of this Committee in 1993, 
one of the main issues that we discussed during the time when Don 
Riegle was the Chairman of the Committee was credit availability, 
particularly to those at the lower end of the economic scale. And 
there was a great deal of concern that financial institutions were 
not making credit available to those in the minority community or 
in the lower economic end of the scale because they wanted to pro- 
tect the safety and soundness of their institutions. Burned by the 
savings and loan experience, they wanted to make sure that every 
loan they made was absolutely safe, to the point that they were not 
making loans. And they preferred to put their money into Govern- 
ment securities and earn money that way without taking the risk 
in the marketplace of making loans. 

So the focus of the Committee at that time was on the question 
of how loans could be made available, how credit could be made 
available across the spectrum of America. My concern, as I sit 
through these hearings and listen to some of the requests being 
made in the name of more consumer information, is that we might 
inadvertently get into the position where we are once again shut- 
ting off credit to that portion of the economy that badly needs it. 

I have often said that the best place to hide a leaf is on the floor 
of the forest in open sight, surrounded by all of the other leaves. 
It becomes impossible for you to pick it up. Much of the problems 
that I have found in life with respect to disclosure of consumer 
rights is that we end up hiding a whole bunch of leaves. We end 
up with documents that are very thick and procedures that are 
very onerous, and we say, well, we are just making sure they get 
full disclosure. And that kind of full disclosure becomes, in effect, 
nondisclosure because you cannot pick out of it what really matters 
and understand what is really going on. 

I am looking forward in this hearing to hear from the regulators 
and from the consumer advocates as to what would be the most 
meaningful disclosure that would give us transparency so that the 
customer understands what is going on and at the same time not 
clog up the system with so many “consumer protections” that would 
end up taking us back to the bad old days when credit was not 
available to people who desperately need it. 

I think you have assembled a panel that can address that issue, 
and I appreciate your leadership in this entire effort. 
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Chairman Shelby. Thank you. 

Senator Stabenow. 

STATEMENT OF SENATOR DEBBIE STABENOW 

Senator Stabenow. Thank you, Mr. Chairman, for holding this 
hearing. I apologize in advance for having to leave to go to the floor 
in a moment, but I did want to be here to say thank you to those 
who are speaking, and I look forward to your testimony and having 
an opportunity to review your testimony. 

As our Ranking Member, Senator Paul Sarbanes mentioned, 
there are a number of us that are working on the issues not only 
of understanding the credit system but also understanding finan- 
cial literacy in total. And I thank Senator Sarbanes, as well as the 
Chairman and others for their efforts. Senator Enzi and I have 
been working now for a number of months on an approach to, in 
fact, bring together all those who provide financial literacy pro- 
grams of some kind, as well as a website and a 1-800 number and 
other opportunities for people to be able to go to one spot and be 
able to get information so that they can not only get their credit 
reporting information in terms of how to access it, but also addi- 
tional information as well. 

I think it is an important hearing, and hopefully we can all work 
together to put this concept into law and be able to make informa- 
tion more readily available to consumers to be able to access infor- 
mation and empower them with knowledge that they need in order 
to manage their own financial affairs. 

Thank you, Mr. Chairman. 

Chairman Shelby. Senator Enzi. 

STATEMENT OF SENATOR MICHAEL B. ENZI 

Senator Enzi. Thank you, Mr. Chairman. I have a complete 
statement that I would like to submit for the record. 

Chairman Shelby. Without objection, it will be made part of the 
record. 

I want to thank you so much for holding this hearing today. We 
are finally to the heart of fair credit reporting: The consumer. I 
really prefer to call them “customers.” I think that elevates them 
to 

Chairman Shelby. They were your customers, weren’t they? 

Senator Enzi. Yes. 

[Laughter.] 

That elevates them to being the heart of the economic engine, 
which is what they really are. Without the customer there isn’t an 
economy. This will bring out some things that will help us a lot in 
designing some bills that will help the customer to get both the 
credit they need and the credit for what they do. 

There have already been some significant steps in this area, and 
I appreciate Senator Sarbanes’ efforts last year at promoting finan- 
cial literacy. I had an opportunity to do a little bit of research, and 
in Wyoming, we have a significant effort that is being done by 
Fannie Mae, the Wyoming Community Development Association, 
which provides low-cost housing, the realtors, the bankers, and the 
credit unions. And that is a special program that is done on com- 
pressed video to a number of sites around the State at one time so 
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that people can learn the intricacies of buying a house. If you take 
the course, you also get a discount on your loan, so there is some 
real big incentive for doing it. 

Several thousand people have already taken that, and now they 
are looking at moving that down into the high schools as a part of 
the curriculum. I think it will make a tremendous difference to 
young people, particularly. 

I was Mayor of Gillette when it was a boom town. We had a lot 
of young people coming to take on the jobs, and even clear back 
then they were making $50,000, $60,000 a year, and going broke. 
And they did because their parents had all these different things 
that they owned, and they were making a lot less, so the kids went 
out and bought all of those things at once, and then found out that 
the payments were more than their income. 

I tried to find some way to get some credit counseling for them, 
and we did that through some associations and through the credit 
unions, who have even gone into the schools and put on classes for 
kids and organized many banks so that they can have an emphasis 
on savings and get a little bit of information on how credit cards 
affect them. 

So there are some efforts out there, and Senator Stabenow and 
I have been working on a bill trying to figure out a way — and I 
think we have got it — that people can have an entry ramp to the 
information that the Federal Government has on financial literacy, 
and that we can make that available to these customers so that 
they can be better customers. 

I thank you for the part that this will play in the activity that 
we are doing. 

Thank you. 

Chairman Shelby. Thank you. Senator Enzi. 

Our panel today, we want to welcome you all again. We have Ms. 
Dolores Smith, Director, Division of Consumer and Community Af- 
fairs, the Board of Governors of the Federal Reserve System; Ms. 
Donna Gambrell, Deputy Director of Compliance and Consumer 
Protection, Federal Deposit Insurance Corporation; Mr. Joel Win- 
ston, Associate Director, Financial Practices Division, Bureau of 
Consumer Protection, Federal Trade Commission; Mr. Travis 
Plunkett, Legislative Director, Consumer Federation of America; 
Ms. Stacey D. Stewart, President and Chief Executive Officer of the 
Fannie Mae Foundation; Ms. Cheri St. John, Vice President of 
Global Scoring Solutions, Fair Isaac Corporation; Mr. Scott 
Hildebrand, Vice President of Direct Marketing Services, Capital 
One Financial Corporation. 

I welcome all of you here. All of your written statements will be 
made part of the record in their entirety. There are seven of you 
here. We have six microphones, so somebody will have to share a 
little bit. But if you will quickly sum up your top points, that will 
enable us to ask you some questions. 

Ms. Smith, we will start with you. 
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STATEMENT OF DOLORES S. SMITH 
DIRECTOR, DIVISION OF CONSUMER AND 
COMMUNITY AFFAIRS 

BOARD OF GOVERNORS OF THE FEDERAL RESERVE SYSTEM 

Ms. Smith. Thank you, Mr. Chairman. 

Mr. Chairman and Members 

Chairman Shelby. Bring your microphone up. You can share it 
with her later. 

Ms. Smith. Okay. Is that better? 

Senator Sarbanes. It would be better if you pulled it quite close. 

Chairman Shelby. A little closer. 

Ms. Smith. All right. Mr. Chairman and Members of the Com- 
mittee, I appreciate the opportunity to testify on the significance of 
maintaining a reliable national credit reporting system, on the im- 
portance of the Fair Credit Reporting Act to that system, and on 
the need for consumer awareness of how the credit reporting sys- 
tem functions and how it relates to their ability to obtain credit. 

As the financial services industry has grown larger, financial 
products and services more complex, and the U.S. population more 
mobile, it is no longer feasible for institutions to evaluate the credit 
standing of consumers based solely on their direct experiences with 
consumers. Centralized consumer reporting agencies have evolved 
to provide a repository of credit history information that can be 
accessed by creditors to evaluate prospective borrowers. This na- 
tional credit reporting system provides creditors with an efficient 
and cost-effective method of obtaining data for credit decision- 
making and consumers with increased credit availability. 

The data are limited on what consumers understand about the 
national reporting system, the credit granting process, and how 
their credit report relates to that process. There is anecdotal evi- 
dence that consumers are generally aware of the terms “credit scor- 
ing” or “credit rating,” but they are less clear how credit scores are 
used in credit granting. The national credit reporting system has 
become invaluable to creditors for assessing consumers’ credit- 
worthiness. Thus, it is crucial that consumers understand how this 
system operates and how it impacts their access to credit. Educated 
consumers who make informed decisions about credit are essential 
to an efficient and effective marketplace. Consumers who under- 
stand how their credit-risk profile relates to credit rates and terms 
can better determine which credit product best suits their needs. 

Participation in the U.S. credit reporting system is voluntary. 
Creditors are not required to obtain consumer reports before mak- 
ing credit decisions, although most creditors rely on consumer re- 
ports for risk management. Creditors are not required to furnish 
information to consumer reporting agencies. But if they do, the in- 
formation they furnish must be accurate. 

The Fair Credit Reporting Act contains important consumer 
rights and protections. Several are designed to promote accuracy in 
consumer reports. For example, the right to receive notice if infor- 
mation in a consumer report has resulted in adverse action enables 
consumers to check the accuracy of information in their credit re- 
ports and to dispute the accuracy or completeness of any items of 
information. Other consumer rights and protections are designed to 
protect consumer privacy. 
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The ready availability of accurate, up-to-date credit information 
from consumer reporting agencies benefits both creditors and con- 
sumers. Information from credit reports gives creditors the ability 
to make credit decisions quickly and in a fair, safe and sound, and 
cost-effective manner. Consumers benefit from access to credit from 
different sources, the competition among creditors, quick decisions 
on credit applications, and reasonable costs for credit. 

The FCRA promotes the national credit system in important 
ways. Perhaps most significantly, the availability of standardized 
consumer reports, containing nationally uniform data, allows banks 
to make prudent credit decisions efficiently wherever they do busi- 
ness and wherever their customers live and work. 

Consumer financial education plays an important role in helping 
consumers understand the national credit system. In particular, 
consumers need to be more aware that the accuracy and complete- 
ness of information in their credit files affects the pricing and 
availability of credit. Markets operate more efficiently when con- 
sumers are well-informed. 

The Federal Reserve System recently launched a financial edu- 
cation initiative to encourage consumers to learn more about per- 
sonal financial management. The objective of this nationwide ini- 
tiative is to highlight the benefits of financial education and pro- 
vide information on resources available to consumers for assistance 
in managing their finances. 

The Committee is to be commended for undertaking an examina- 
tion of the Fair Credit Reporting Act and related issues at this im- 
portant juncture. In conducting this examination, it is important to 
work to maintain a viable national credit system that preserves 
and expands reasonable access to credit and to promote consumers’ 
understanding and awareness of the credit reporting system and of 
its impact on their ability to obtain credit and the pricing of that 
credit. 

Thank you. 

Chairman Shelby. Ms. Gambrell. 

STATEMENT OF DONNA GAMBRELL 
DEPUTY DIRECTOR FOR COMPLIANCE AND 
CONSUMER PROTECTION 

DIVISION OF SUPERVISION AND CONSUMER PROTECTION 
FEDERAL DEPOSIT INSURANCE CORPORATION 

Ms. Gambrell. Chairman Shelby, Senator Sarbanes, and Mem- 
bers of the Committee, thank you for inviting me to testify on be- 
half of the Federal Deposit Insurance Corporation. The FDIC has 
been closely following the hearings of the Fair Credit Reporting Act 
and related issues. At stake are matters that affect both individual 
consumers and the manner in which the Nation’s economy oper- 
ates. FDIC Chairman Don Powell has stated his support for mak- 
ing the expiring FCRA preemption provisions permanent. We 
thank you for your careful consideration of these important issues. 

We also commend the Committee’s attention to the difficult prob- 
lems associated with combating identity theft. For its part, the 
FDIC is coordinating an effort among the Federal financial institu- 
tion regulators to publish guidance on measures that should be 
taken when security breaches occur that may lead to identity theft. 
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It is the FDIC’s commitment to consumer protection that com- 
pelled the Agency to assess ways in which a segment of our society 
could gain greater access to the financial mainstream. Policy- 
makers and financial institutions alike have made commendable 
efforts to broaden the scope of banking products for low- and mod- 
erate-income people. However, many families still fall outside of 
the financial mainstream and do not maintain traditional bank 
credit, savings, or investment accounts. According to conservative 
figures, nearly 10 percent of U.S. families do not have banking 
relationships. 

Several studies have shown that financial education efforts can 
raise consumer awareness, foster positive changes in behaviors, 
and better equip consumers to operate within the financial arena. 
We share that point of view. 

The FDIC introduced Money Smart, a 10-module training cur- 
riculum, in the summer of 2001 to help low- and moderate-income 
adults better understand the basics of banking. We designed 
Money Smart to be easy to teach and easy to learn. It can be 
taught in its entirety or in single units. Money Smart is free and 
has no copyright restrictions, so organizations desiring to use the 
program can reproduce and use the training materials as needed. 
Also, banks can get Community Reinvestment Act credit for their 
involvement in offering Money Smart classes in their communities. 

Because immigrant populations represent a significantly under- 
served market, we have translated Money Smart into Spanish, Chi- 
nese, and Korean, and we will have a Vietnamese translation by 
the end of this year. 

To date, we have provided more than 22,000 organizations across 
the country with over 75,000 copies of Money Smart. While we are 
pleased with these numbers. Chairman Powell has set an even 
more aggressive goal for the next 4 years, including: one, exposing 
1 million consumers to our financial education program; and, two, 
linking Money Smart to wealth-building and asset accumulation 
programs, such as homeowner ship initiatives and individual devel- 
opment accounts. We are committed to meeting this goal. 

We believe that a critical factor in the success of Money Smart 
has been our emphasis on working through our regional community 
affairs staff with local organizations that are best situated to bring 
Money Smart to those who can benefit from it. To date, over 340 
organizations throughout the country, in both urban and rural com- 
munities, have joined our Money Smart Alliance as local partners, 
and 20 major private and public sector organizations have joined 
as national partners. These entities represent a wide spectrum of 
delivery systems for our financial education program: Housing and 
social service agencies, financial institutions, colleges and univer- 
sities, community organizations, as well as Government, faith- 
based, and employment organizations. 

As an example, under a partnership agreement with the Neigh- 
borhood Reinvestment Corporation, Money Smart has been used to 
train over 5,500 students in 39 cities over the past year. These stu- 
dents primarily are low-income consumers, minorities, or women 
who are potential homebuyers or existing homeowners having prob- 
lems making ends meet. 
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We recognize the long-term success of Money Smart is largely de- 
pendent on our ability to set measurable goals for the program and 
monitor our results on an ongoing basis. Recently, we completed a 
large-scale survey effort. Based on preliminary results, we estimate 
that the number of participants who have completed at least one 
Money Smart module to date exceeds 100,000. The survey also in- 
dicates that over 13,000 Money Smart participants went on to ini- 
tiate a banking relationship as a result of the program. 

We have a great banking system in this country. We also have 
a credit market that is the envy of the world, and we believe every- 
one should have an opportunity to participate. With Money Smart, 
we believe we have the means to raise consumer awareness about 
bank services, credit, budgeting, and savings, and to offer financial 
alternatives to the most needy in our society. 

Thank you for giving me the opportunity to testify before you 
this morning on this critically important topic. I look forward to an- 
swering any questions you might have. I also make the offer on be- 
half of Chairman Powell to assist any Senator interested in looking 
into establishing Money Smart programs for their communities. 

Thank you. 

Chairman Shelby. Mr. Winston. 

STATEMENT OF JOEL WINSTON 
ASSOCIATE DIRECTOR, FINANCIAL PRACTICES DIVISION 
BUREAU OF CONSUMER PROTECTION 
U.S. FEDERAL TRADE COMMISSION 

Mr. Winston. Mr. Chairman, Senator Sarbanes, Members of the 
Committee, I am pleased to appear today to discuss financial lit- 
eracy as it relates to credit reporting and credit granting. As others 
have said, this is a vitally important subject because our economic 
system and the welfare of our consumers depend on knowledgeable 
consumers making well-informed decisions about their finances. 

I should note that the views expressed in my written testimony 
represent those of the Commission, but my oral presentation and 
answers to questions are my own. 

The Commission has a great deal of experience through its law 
enforcement and education activities in assessing the level of con- 
sumer knowledge in this area. Unfortunately, what we have ob- 
served is consistent with the Consumer Federation study that came 
out yesterday; that is, many consumers have limited knowledge of 
how our credit system works. They may not realize that their 
financial information is compiled and used not only by just credi- 
tors but also by employers, insurers, landlords, and others. They 
may not know how this information affects their ability to get a 
loan, insurance, or a job. They may not understand what rights 
they have to ensure that the information is accurate. And as you 
mentioned earlier, Mr. Chairman, knowledgeable consumers are es- 
pecially important here because the Fair Credit Reporting Act re- 
lies, in important ways, on the vigilance of consumers in protecting 
their rights. Uninformed consumers may not take the steps they 
should to improve their credit ratings or correct errors. 

I would like to talk briefly about the FTC’s consumer education 
program, and I brought along some samples, including our most re- 
cent publication called “Getting Credit,” a primer that will be dis- 



518 


tributed to community colleges around the country, as well as in 
many other venues. And we have other things which are available 
in the back ranging from refrigerator magnets to bookmarks to bro- 
chures of every type on credit topics. 

Senator Sarbanes. Where are those located? 

Mr. Winston. I believe they are just outside on the table, and 
we have a number of copies. 

Consumer education is among our most important tools in the 
fight against fraud and deception. Overall, we have over 30 publi- 
cations on credit issues available directly from the FTC and 
through a variety of partner organizations. Many of them are in 
Spanish, as well as English. 

Credit publications have consistently been among our most pop- 
ular items with annual distribution in the millions. At the same 
time we have partnered with many outside organizations to im- 
prove consumers’ understanding of credit, ranging from the CFA to 
the Jump$tart Coalition to the Department of Defense. For exam- 
ple, our Northeast Office works with colleges and universities in an 
effort called Project Credit Smarts, in which we make presen- 
tations and distribute credit-related publications during student 
orientation sessions. 

Our identity theft program is another way in which we educate 
consumers about credit. One of the most devastating consequences 
of identity theft is the damage that it causes to the victim’s credit 
record. We offer publications with tips on how to avoid identity 
theft and what to do if it happens, and these publications have 
been extremely popular. 

We should also remember that the FCRA itself serves an impor- 
tant educational function. Perhaps most important, the law re- 
quires that users of credit reports notify consumers when they take 
adverse action based on information in a report. The notice must 
tell consumers what credit bureau supplied the report, and advise 
consumers of their rights to a free copy of that report, and to dis- 
pute the accuracy of the information in it. Consumers get this in- 
formation when they are motivated to act on it. 

The FTC’s legislative recommendations about which Chairman 
Muris testified before this Committee on July 10, would result in 
better educated consumers. Our proposals would put more informa- 
tion in consumers’ hands by first expanding consumers’ rights to 
adverse action notices when they are offered less favorable credit 
terms; second, making annual credit reports available at no charge; 
third, giving consumers more information about their credit scores, 
along with explanatory materials; and fourth, making it easier for 
consumers to correct errors in their report. 

Thank you for the opportunity to discuss this important subject, 
and I will be happy to answer any questions you may have. 

Chairman Shelby. Mr. Plunkett. 

STATEMENT OF TRAVIS B. PLUNKETT 
LEGISLATIVE DIRECTOR 
CONSUMER FEDERATION OF AMERICA 

Mr. Plunkett. Good morning. Chairman Shelby, Ranking Mem- 
ber Sarbanes, and the Members of this Committee, my name is 
Travis Plunkett, and I am the Legislative Director of the Consumer 
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Federation of America. I applaud the Committee for conducting a 
hearing on such an important and little understood subject. 

In response to the invitation to testify here today, the Consumer 
Federation of America commissioned a study about consumer 
knowledge of credit reports and credit scores, and about the level 
of public support for a variety of protections that this Committee 
may consider. More than a thousand adults were interviewed. 
Overall the survey found that a large number of Americans not 
only do not understand basic facts about credit scores and reports, 
but also admit their lack of knowledge about this subject. That is 
a finding that you sometimes do not find in these kinds of public 
surveys, that people acknowledge their lack of understanding and 
then show it. An important finding of the survey is that low- and 
moderate-income Americans — who tend to pay the highest price for 
credit and are the most vulnerable to inaccurate credit scores — are 
the least knowledgeable about credit reports and credit scores. 

We also found that a breathtaking number of Americans believe 
they need greater credit reporting rights. They want easier access 
to their credit reports and scores, greater protections against pri- 
vacy and credit reporting abuses, and the right to go after lenders 
in court who repeatedly make grievous reporting errors. 

Let me give you some details. First, in questioning Americans 
about what they say they know, 50 percent said their knowledge 
of credit reports was fair or poor. While, 61 percent said they had 
a fair or poor awareness of credit scores. Lower-income Americans 
are the most likely to believe that their understanding is not good. 
More than 60 percent of those in households with incomes under 
$35,000 a year said their knowledge of credit reports was fair or 
poor. That number rose to 70 percent for credit scores. Young 
adults were also likely to say that their knowledge was not good. 
Sixty two percent said their awareness of credit reports was fair or 
poor, 78 percent for credit scores. 

Now we get to the second part. We tested actual consumer 
knowledge about credit reports and scores, and the results were no 
better. Only 25 percent of Americans and less than 20 percent with 
incomes below $35,000 said they knew what their credit score was. 
Forty three percent of Americans, and only 35 percent of those with 
incomes under $35,000 a year, said they had obtained a copy of 
their credit report from the three credit bureaus in the past 2 
years. On the pop quiz portion of the survey, only 3 percent of 
Americans could, unprompted, name the three main credit bu- 
reaus. I am not sure we’d get a better response in this room either. 

The survey also tested consumer knowledge using a series of 
true/false questions. The good news is that large majorities know 
that consumers have the right to see their credit report, and that 
consumers who fail to qualify for a loan have the right to a free 
credit report. Now the bad news, a majority of Americans did not 
know several important facts: That in most States they must pay 
a fee to obtain their credit report; that their credit score may be 
lowered if they use all of the credit available on their credit card; 
that their credit score may be lowered if they apply for a credit 
card; and that they are not required to contact their lenders if they 
believe their credit report or score is inaccurate. As you all know, 
they must go to the credit bureau. Also, 27 percent incorrectly be- 
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lieve that their credit score mainly measures their knowledge of 
consumer credit as opposed to their creditworthiness. 

We also found that a large number of Americans are unaware 
that credit scores are increasingly being used by electric utilities, 
insurers, landlords, and cellular telephone companies to decide 
whether they can purchase a service and at what price. By com- 
parison, only 13 percent did not know that credit cards used credit 
scores, credit card companies I should say. 

Finally, we questioned Americans about their opinions on new 
consumer protections that are being floated in Congress. We found 
overwhelming support, generally at the 80 to 95 percent level for 
a number of reforms, requiring credit bureaus to better verify iden- 
tities on credit applications in order to reduce identity theft; allow- 
ing consumers to obtain a free credit report and credit score once 
a year from the three main credit bureaus upon request; requiring 
lenders to give consumers who are denied a loan or charged a high 
rate, a free copy of the credit report and the score used as the basis 
for the lender’s decision; requiring banks to obtain a consumer’s 
permission before sharing financial information with affiliates; pro- 
hibiting the use of medical information to make credit decisions 
without a consumer’s consent; and allowing consumers to sue lend- 
ers who knowingly provide credit bureaus with incorrect, damaging 
information. When quizzed about the practice of credit card compa- 
nies raising interest rates for a problem, a credit problem with an- 
other lender, Americans overwhelmingly opposed that practice. 

I have summarized the findings of this survey. My written testi- 
mony also includes a number of public policy recommendations on 
how to deal with some of the findings of the survey and what they 
lead to. 

Let me close by talking about one other finding and conclusion 
based on our survey. The survey also points to the need for a long- 
term strategy to boost general financial awareness and to improve 
financial decisionmaking by Americans. Thankfully, Senators Sar- 
banes, Shelby, Stabenow, Enzi, and Akaka have all shown a great 
deal of interest in improving financial education efforts in this 
country. For instance. Senator Sarbanes recently introduced his bill 
to create a Financial Literacy and Education and Coordinating 
Committee within the Department of the Treasury. We think this 
proposal has great merit, and we support it. We would also encour- 
age this Committee to look at broader solutions to improving finan- 
cial literacy throughout this country over the long term. 

Thank you. 

Chairman Shelby. Ms. Stewart. 

STATEMENT OF STACEY D. STEWART 
PRESIDENT AND CHIEF EXECUTIVE OFFICER 
FANNIE MAE FOUNDATION 

Ms. Stewart. Mr. Chairman, Ranking Member Sarbanes, and 
Members of the Committee, good morning. My name is Stacey 
Stewart. I am the President and CEO of the Fannie Mae Founda- 
tion. As you may know, the Fannie Mae Foundation is a separate 
organization from Fannie Mae, though funded exclusively by 
Fannie Mae. It is an honor to have this opportunity to address the 
Committee. 
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The mission of the Fannie Mae Foundation is to give more Amer- 
icans access to homeownership and all Americans access to decent, 
safe, and affordable housing. We are driven by the conviction that 
the expansion of homeownership is both an economic and ethical 
imperative. It is a matter of both fiscal health and social justice. 

We are, therefore, grateful for this opportunity to discuss the 
Foundation’s activities in promoting financial literacy. As we guide 
people down the pathway to homeownership, we try hard to help 
them understand the critical importance of acquiring and main- 
taining good credit. 

Research, anecdotal evidence, and reports from the many na- 
tional and community-based organizations with which we work all 
tell us the same unsettling story. Far too many consumers, and far 
too many aspiring homeowners, do not understand the link be- 
tween good credit and their ability to get a home mortgage. 

In a survey the Fannie Mae Foundation commissioned in 1999, 
almost 70 percent of African-Americans and Hispanic-Americans 
expressed a belief that paying their bills late would represent only 
a minor problem or no problem at all in obtaining a mortgage. 

More recent research tells us that 40 percent of all African-Amer- 
icans and 60 percent of Hispanic-Americans believe you need a per- 
fect credit rating in order to qualify for a mortgage, and roughly 
40 percent of minorities believe that you need a 20 percent down- 
payment in order to buy a home. As those of you before me know, 
of course, none of these beliefs are true. 

Yet the problems run even deeper. The sunshine provisions of 
the Fair Credit Reporting Act also are not well understood. In 
2002, the Fannie Mae Foundation helped fund research among 
high school seniors to understand where and how to start encour- 
aging financial literacy. Sixty percent of the respondents did not 
know the conditions under which they could access their credit re- 
port. I think you might find this particularly interesting, Mr. 
Chairman: more than 12 percent of those graduating seniors ex- 
pressed the view that one’s credit record is the property of the U.S. 
Government and can be viewed only by the FBI and lenders. 

This suggests a problem that goes far beyond fair credit report- 
ing. It suggests we must do more to overcome the information def- 
icit that remains the most formidable barrier to financial literacy. 

Up to this point, I have focused on consumers who misunder- 
stand credit, how it is reported, and what that means for them. But 
there is a large and growing number of our citizens who are simply 
excluded from the credit reporting system. 

This is a huge concern. Millions of Americans are operating out- 
side of the country’s mainstream financial system. They do not 
have meaningful credit records, and they do not have the oppor- 
tunity to benefit from timely payment of crucial monthly charges, 
such as rent and utility bills. 

Without a record of their responsible payment history, these 
Americans cannot secure credit from mainstream financial institu- 
tions. As a result, many turn to high-cost, alternative financial 
services. In fact, according to the GAO, 22 million households lack 
as basic a financial service as a bank account. 

How likely is it that consumers who lack even a basic bank ac- 
count understand credit reporting systems? These consumers pay 
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high fees for credit from alternative lenders and then receive no 
benefit in mainstream financial institutions for repaying those 
loans on time because such transactions are not captured by the 
mainstream credit reporting system. 

Information such as this defines our challenge, and it explains 
why consumer education initiatives are at the heart of the Fannie 
Mae Foundation’s agenda. Our financial literacy efforts are de- 
signed to give Americans the information they need to take control 
of their financial future. 

In 2002 alone, more than 800,000 individuals requested or 
downloaded our free instructional guides on credit and the 
homebuying process. Since 1993, we have made these guides avail- 
able in 9 languages and have delivered them to more than 14 mil- 
lion Americans. Our 30-minute instructional video, “Knowing and 
Understanding Your Credit,” and its Spanish-language counterpart 
that aired on Black Entertainment Television and Telemundo affili- 
ates, respectively, throughout the Nation in 2002. Our foundation 
invests $3 million annually in the most effective homeownership 
and credit education providers around the country. We have also 
launched research to improve the design and the delivery of these 
services. And we are funding promising research aimed at pro- 
ducing innovative strategies for bringing mainstream financial 
services into underserved and overlooked communities. 

At the Fannie Mae Foundation, we are very proud of our con- 
sumer outreach initiatives, but we know we must do more, and we 
are committed to doing so with an abiding understanding of our re- 
sponsibility to lift Americans out of the darkness of financial illit- 
eracy into the light of financial opportunity. I am confident that 
this Committee shares our commitment. 

To expand homeownership and help millions of low- and mod- 
erate-income Americans build assets. We must enhance their un- 
derstanding of credit and the relationship between credit reporting 
and their ability to secure a mortgage. This is an essential step in 
helping all of our citizens become active and knowledgeable partici- 
pants in the financial life of our Nation. It is also the first in help- 
ing low- and moderate-income Americans fully participate in the 
American economy and, ultimately, the American Dream. 

Mr. Chairman, I thank you, and I will be happy to answer any 
questions the Committee may have. 

Chairman Shelby. Ms. St. John. 

STATEMENT OF CHERI ST. JOHN 
VICE PRESIDENT OF GLOBAL SCORING SOLUTIONS 
FAIR ISAAC CORPORATION 

Ms. St. John. Mr. Chairman, Members of the Committee, my 
name is Cheri St. John, and I am the Vice President of Global 
Scoring Solutions for Fair Isaac Corporation. Thank you for the op- 
portunity to testify about what Fair Isaac is doing to improve con- 
sumer understanding and awareness of the credit granting process 
and what can be done to make even more usable information avail- 
able to consumers. 

Fair Isaac invented statistically based credit risk evaluation sys- 
tems, commonly called credit scoring systems. Thousands of credit 
grantors use the scores known as FICO scores, generated by Fair 
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Isaac scoring systems, implemented at the three national credit re- 
porting agencies. 

There are many different kinds of credit scores. The most well 
known are the credit risk scores, developed by Fair Isaac, known 
as FICO scores and widely distributed to lenders by the three na- 
tional credit bureaus. In addition, there are broad-based credit 
scores developed by each of the three bureaus and third-party de- 
velopers. There are custom scores, scores for specific industries, 
and there are scores distributed primarily to the consumer market. 

There are three main points I would like to highlight today. 
Point one: Although there is a lot of educational information al- 
ready available to consumers, we need to work together to let them 
know it is there. As credit scoring has grown. Fair Isaac has re- 
sponded by providing consumers with the information they need to 
understand credit scoring and to use that to take control of their 
credit health. We started in June 2000 by publicizing all of the fac- 
tors used in the FICO scores. Nine months later, consumers could 
get their own FICO score and the accompanying underlying credit 
report, as well as a complete explanation of their personal FICO 
score. Since then, our FICO score simulator and many additional 
services have been added to Fair Isaac’s website, www.myfico.com. 

Free information has been available to consumers at that website 
since its inception, including a weighting of the credit report factors 
in the FICO scores so that consumers know what events or behav- 
iors have the greatest influence on the scores in general. It indi- 
cates what information is not included in the FICO scores and of- 
fers free advice on what actions consumers should take or avoid 
taking to improve FICO scores over time. There is too much infor- 
mation on the website to describe here, or even in our written 
statement, so I urge you to visit www.myfico.com to see for your- 
selves the breadth and quality of the information available there. 

Fair Isaac also makes information available about FICO scores 
by U.S. Mail, and collaborates with Equifax and TransUnion to 
make information available to consumers directly from those two 
agencies. The information is there. We all need to work together 
to help consumers know where to get the information that will help 
the most. 

Point two: To be well-educated, consumers must know and un- 
derstand the credit score lenders are using to evaluate them. Col- 
leges typically use the SAT score to evaluate students who apply 
for admission. Students know this, and use that same score to de- 
cide where to apply or which colleges might accept them. Although 
a different aptitude test might provide the student with some use- 
ful information, prospective students get the greatest benefit from 
knowing their own SAT score, empowering them to judge for them- 
selves how they may be viewed by a college admissions office. The 
same is true for credit scores. Consumers should know and under- 
stand the credit score that lenders use. 

Point three: Score disclosure legislation should require agencies 
to provide the broad-based credit score the agency most widely dis- 
tributes to lenders and give consumers the right to choose a dif- 
ferent score that is widely distributed. 

We have made a good start at educating the American consumer 
about the credit granting process, but more can be done. Credit 
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scoring can be confusing and it becomes more confusing if the con- 
sumer gets one score when the lender uses something else. If, as 
we suggest, mandatory score disclosure gives the consumer the 
choice and defaults to the score that the agency distributes most 
widely to lenders, the consumer is in charge rather than the agency 
or the score developer. Furthermore, the uninformed consumer who 
needs help the most is likely to get a useful score, by defaulting 
to the score the agency distributes most widely to lenders. 

In conclusion, there is much valuable information about credit 
scoring available to consumers as a paid service and free. Con- 
sumer education will be improved if consumers can get the scores 
most widely distributed to lenders or another score of their choice. 

I thank you for the opportunity to share Fair Isaac’s expertise 
and experience in this important area and I would be happy to an- 
swer your questions. 

Chairman Shelby. Mr. Hildebrand. 

STATEMENT OF SCOTT HILDEBRAND 
VICE PRESIDENT, DIRECT MARKETING SERVICES 
CAPITAL ONE FINANCIAL CORPORATION 

Mr. Hildebrand. Chairman Shelby, Ranking Member Sarbanes, 
Members of the Committee, my name is Scott Hildebrand, and I 
am appearing before you on behalf of the Capital One Financial 
Corporation, where I serve in the capacity as Vice President of Di- 
rect Marketing Services. On behalf of Capital One, let me express 
my thanks to you for your leadership you have shown on this issue. 

Capital One is one of the 10 largest credit card issuers in the Na- 
tion, and a diversified financial services company with over 45 mil- 
lion customers and $60 billion in loans outstanding. 

At Capital One, we believe that a thorough understanding of fi- 
nancial matters not only helps consumers to make better decisions, 
but also helps to ensure the continued health of the financial serv- 
ices industry. We are not successful if our customers fail to manage 
their personal finances effectively, and thus are unable to meet 
their credit obligations. 

Capital One believes that clear communications about its prod- 
ucts and services is important to maintaining successful relation- 
ships. Our best channel and our most direct vehicle for reaching 
out to our cardholders is their monthly statement. We include fi- 
nancial tips that are pertinent to their account in prominent loca- 
tions on the statement where it is likely to be noticed. 

Understanding that Capital One may be the first credit card for 
many cardholders, we built financial education into all product 
touchpoints. Upon activation of the card, these cardholders receive 
a welcome booklet explaining the ins and outs of credit. Our mes- 
sage focuses on the importance of building a positive credit history. 

During the first year with Capital One, cardholders receive quar- 
terly reminders about the importance of maintaining good credit 
habits. Created with Myvesta.org and Jump$tart Coalition for Per- 
sonal Finance, these reminders provide more detailed information 
on numerous personal finance topics. For other customers we place 
the financial toolbox on Capital One’s website, which includes 
guides, articles, and calculators to give consumers a better under- 
standing of how to use our products. 
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We also believe it is important to reach out beyond our customer 
base. Several years ago, we undertook a major corporate initiative 
to develop a financial education program. Following the Capital 
One method of doing business, we started by surveying the market 
to assess the delivery and methodology used by financial education 
programs. As a result of our research, we initially decided to focus 
on those most in need, lower-income and underbanked populations. 
As a result, we decided the best approach would be to find a strong, 
nonprofit organization with who we could partner. We contacted 
Consumer Action. 

Since beginning our partnership, we have developed a highly ef- 
fective collaboration that has produced measurable results. Capital 
One has donated approximately $11/4 million to create and imple- 
ment MoneyWi$e, a program that offers straightforward easy-to- 
read information to address financial responsibility. Together, we 
have created a four-part series of MoneyWi$e educational materials 
that provide the basic building blocks for developing and honing 
personal finance skills. These include: Building good credit, credit 
repair, basic banking, and basic budgeting. 

Capital One’s financial support of this program ensures that 
these materials are provided to nonprofit organizations and con- 
sumers free of charge. The materials are also available in four lan- 
guages in addition to English including Spanish, Chinese, Korean, 
and Vietnamese. This ensures that we are able to reach immigrant 
groups, many of which have had negative experiences with banks 
in their home countries and are vulnerable to unscrupulous finan- 
cial service providers. 

Five years ago, we joined Jump$tart. The premise behind our 
support of this program is simple. We believe in their mission to 
teach financial education in the public schools. Based on this belief, 
we provided financial support for the integration of Jump$tart’s 
Money Math Curriculum into the Virginia school standards. 

Capital One has developed a unique method to reach college stu- 
dents. We decided to experiment with a method that utilizes stu- 
dents’ relationships with their peers. Last year, we piloted 
MoneyWi$e for college students, a train-the-trainer program that 
teaches college students how to become “money mentors” and to de- 
liver personal finance curricula to other students. Currently, the 
program is delivered on three college campuses, including the Uni- 
versity of South Florida, Texas A&M, and Washington State. Be- 
cause of the success of this test, we are currently in talks to expand 
the program to additional schools this fall including the University 
of Maryland, Penn State and the University of Alabama. 

The workshops cover a broad range of topics from how to main- 
tain a checking account to understanding credit reports. The pro- 
gram results have been impressive with 100 percent of participants 
willing to recommend the program to other students. 

At Capital One, we believe in the principle that knowledge is 
power. Our products work best if our consumers manage their fi- 
nances responsibly. For us, educated consumers, customers who 
know their annual percentage rate they are paying, who know 
when their bills are due, and who know and understand how to 
manage the products we offer, are our best customers. 
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Mr. Chairman, Ranking Member Sarbanes and Members of the 
Committee, thank you again for the opportunity to testify before 
you today. I will be happy to answer any questions you may have. 

Chairman Shelby. I want to thank all of you. 

Mr. Plunkett, I am going to ask you this question. First, I am 
going to make a statement. 

The Consumer Federation survey results indicate that there is a 
troubling lack of awareness regarding many crucial financial mat- 
ters. One of the things that I am concerned about is the seeming 
lack of understanding consumers have about the fact that creditors 
make decisions about them based on their entire credit profile. I 
think the results of one of your survey questions indicate that most 
consumers do not recognize that simply applying for or obtaining 
an additional credit card can have negative consequences for their 
credit score. 

Mr. Plunkett, how can we improve consumer understanding of 
the fact that creditors look beyond their credit history and examine 
their whole credit profile? 

Mr. Plunkett. Senator, we have two suggestions in our written 
testimony, one broad and one narrow. The first is to get consumers 
more information up front so that they can prevent problems before 
they occur, and this goes to their recommendations for a free credit 
report annually upon request and a free credit score annually upon 
request. This is a slow process, but as access to this information 
is improved, as consumers use it more, as they are allowed to pre- 
vent problems before they occur, they will slowly learn more about 
the factors that are used in considering their credit history. 

The second set of recommendations are very targeted, and they 
go to improving the dispute resolution process so that when con- 
sumers have what educators might call a teachable moment, that 
is, they are about to be denied credit, they get information at that 
time from the lender about this situation. They get their credit re- 
port. They are allowed to look at that and correct errors. 

You are touching on an even broader issue, which is that experi- 
ence and transaction information is used as part of a credit profile 
to market to consumers, to develop new products, et cetera. My 
view is that the more consumers get access to their actual credit 
report and score, the more we engage them in this information, the 
more we talk about the variety of purpose for which creditors use 
this information, as you are intimating, it is not just the granting 
of credit that is involved, the more we can raise awareness of con- 
sumer knowledge there. 

And also, the thing to do of course is to give them the protection 
that you have been advocating for years, which is the ability to say 
no to the sharing of this information, especially among financial af- 
filiates. That more than anything is going to confront them with a 
choice. The financial institution is going to make the pitch. They 
are going to say, this is why this information is good for us to 
share. This is how it helps you. And whether it is an opt in or an 
opt out, that decision, more than anything, will educate the con- 
sumer about what this information is being used for, and then they 
will be able to make a decision about whether they want it shared 
or not. 
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Chairman Shelby. Ms. Stewart, what do you think is the hest 
method to expand consumer awareness of how the credit system 
evaluates them? 

Ms. Stewart. Obviously, the need to increase awareness among 
consumers is vital. It is important for those that are particularly 
not in the credit reporting system right now to understand what 
it would take for them to actually get into the credit reporting sys- 
tem, and not only establish good credit but also maintain good 
credit over the long term. That is why we invest so much of our 
resources into building educational support systems that would 
provide this kind of information to consumers. 

The thing that is most important for the Fannie Mae Foundation 
though is making the distinction between having an established 
credit record and people that are creditworthy. What we find 

Chairman Shelby. Two different things. 

Ms. Stewart. Those are two different things. As I mentioned 
earlier in my testimony, there are 22 million households who are 
unbanked, who have no relationship with a financial institution, 
and therefore have a much more difficult time establishing a credit 
record. That is 56 million individuals in this country. We believe 
it is very important to figure out how to move those 56 million peo- 
ple into the mainstream of financial activity in this country. One 
of the things that we provide in our “Knowing and Understanding 
Your Credit” brochure, which we provided copies of to the Com- 
mittee, * is how to begin talking to a lender about nontraditional 
sources of credit, rent, utilities, other kinds of sources of credit that 
could actually bolster one’s own discussion with a lender or a credit 
provider about one’s creditworthiness, so that in case some credit 
information is not captured in a credit history, there is still a way 
for an individual to make a case that they are still a creditworthy 
individual. So there is a bit of awareness in education that is pro- 
vided, but there is also some empowerment by consumers that we 
think we can do more of. 

Chairman Shelby. Thank you. 

Senator Sarbanes. 

Senator Sarbanes. Thank you, Mr. Chairman. This has been an 
extremely interesting panel, and I think it underscores in many re- 
spects the difficulty of the problem we are trying to deal with. 

Actually, Ms. St. John, I like the logical construct you used in 
your statement. You said first, the information is there, but we 
have to show the consumer how to get it, and obviously we need 
to look at the premise of that, whether the information is there in 
all instances or whether there is more, but it is quite a reasonable 
point. It is there. Are they gaining access to it? And then your next 
logical point which I thought was extremely important is, how can 
the consumer understand the information that they get? I am 
struck by all of this material from the FTC that is in that plastic 
bag there, that we have a set of I note that identity theft is obvi- 
ously a fast-growing problem because there is a lot of material in 
here on identity theft. So, I think that underscores that issue. 

There is an awful lot of material here. But, one, how does a con- 
sumer get it, and then what use is a consumer able to make of it? 


*Held in Senate Banking Committee files. 
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I mean do they really understand it? How do we do that education 
process? 

I just want to ask first though some questions about the informa- 
tion they can get to begin with, to go right back to the premise. 
Mr. Winston, you stated in your testimony that FCRA itself serves 
an important educational function. Perhaps, most important, the 
law requires that lenders and other users of credit reports notify 
consumers when they take adverse action based on information 
from a credit report. So then the consumer knows that they are 
getting an adverse action because of their credit report. They are 
able to check their credit report to see whether the information 
upon which this is based is accurate. 

But Ms. Smith noted when a consumer accepts a creditor’s offer 
of credit, even on different terms from those that were requested, 
an adverse action notice is not required. Of course, that raises a 
question whether an adverse action notice should be required when 
a consumer is denied the best credit rate offered by a company. In 
that situation, it is not a rejection of credit. It is putting them in 
a higher credit payment situation. What is your view on if they are 
offered less credit at less than most favorable terms, whether that 
is an adverse offer and should require an adverse notice. 

Mr. Winston. Under current law, it would require an adverse ac- 
tion notice if you got less favorable terms unless there were a 
counteroffer that you accepted in the credit situation. There is that 
caveat there. We have proposed that that be changed, that the 
Commission be given rulemaking authority to close that loophole 
because we believe it is a loophole. We think that in an era of risk- 
based pricing where very few consumers are actually turned down 
any more, but instead you get a higher rate or less favorable terms, 
that is the adverse action consumers should be informed of and 
given a right to look at their credit report and dispute any errors. 

Senator Sarbanes. Mr. Plunkett, did you want to add to that? 

Mr. Plunkett. That is an extremely important proposal. It goes 
to the heart of modernizing the Fair Credit Reporting Act for con- 
sumers given the trend in risk-based pricing. These days people 
with slightly blemished credit are much more likely to be offered 
a credit card or a mortgage loan at a higher interest rate, maybe 
with higher fees, than they are to be turned down. This goes to 
Senator Bennett’s point. Instead of throwing information at con- 
sumers, let us let them know that they are not being offered the 
most favorable rate because of a blemish on their credit. Let us 
eliminate the counteroffer loophole and tell them this up front. 
Then that will trigger their FCRA rights to get the credit report 
and to check for problems. 

Senator Sarbanes. Is there anyone at the table who disagrees 
with this? 

Ms. Smith. I have a question as to the implementation of such 
a rule. Let me say that this rule comes from Regulation B because 
the application of the adverse action notice requirements on Fair 
Credit Reporting parallel, by law, the ones that we have under the 
Board’s Regulation B. Basically, the position that is taken in the 
Regulation is one that was set certainly in the days before risk- 
based pricing, and it was set both to give a bright-line test for 
when is an adverse action notice required or when is it triggered? 
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Then also to avoid confusion on the part of a consumer who might 
receive a credit card, for example, in the counteroffer situation, and 
then simultaneously receive an adverse action notice saying your 
credit was granted but it somehow suffered because of information 
in your credit report or information about you and your credit expe- 
riences. So that is the context in which it was established. 

If the rule is changed, I think that there would be some practical 
difficulties in determining what exactly represents an adverse or 
an unfavorable term in the sense that with risk-based pricing, 
where you do have complexity in the pricing structure, where you 
have ranges — the example I used in the statement was from 7.9 to 
14.9. And if someone receives the 8.9, because it is not the most 
favorable, the person would receive an adverse action notice. 

I guess I also have a question as to practical impact in the sense 
that if someone receives a notice saying that they did not receive 
the most favorable rate based on information in their credit report, 
how likely is that individual to follow up? They will have the oppor- 
tunity and be alerted that there is information in their credit re- 
port. The question is how likely is someone who knows that he or 
she has a credit history that is not stellar, that does have some 
blemishes, to follow up by asking for the credit report? It is only 
an issue of the likely impact that it might have, so certainly mak- 
ing credit reports available is something that would be valuable to 
the consumer. 

Mr. Winston. If I might just respond to that. I agree with Ms. 
Smith that there are complexities, and we want to avoid a situation 
where in essence everyone is getting an adverse action notice be- 
cause no one ever gets the absolute best rate, but I think those are 
complications that can be resolved through a fact-gathering process 
and a rulemaking. 

I do not think it is necessary that the adverse action notice be 
negative in the sense of we have done something bad to you. It can 
simply be a statement of fact that we looked at your credit report, 
and something in that report resulted in you getting the offer that 
you got. It just triggers in the consumer’s mind that this factored 
into their decision, and that is where I think the educational func- 
tion comes in. I think there are a lot of consumers out there who 
apply for a loan, are offered 7 percent, and have no idea that it was 
not 6 percent because of their credit report. It would never even 
occur to them. I think consumers in that situation should be told 
that the credit report was factored in, you have a right to get it, 
and here are your rights, so that particular consumer can check 
and make sure there are not mistakes. I think that can be done 
through a rulemaking in a way that makes sense and balances 
these different interests. 

Senator Sarbanes. Of course, the other thing is even if they 
check it and there is no mistake, it drives home to the consumer 
the lesson that they need to pay attention to their credit record. 
Otherwise, it is going to have an adverse impact on their financial 
situation. That is part of the educational function, as well I would 
assume. 

Mr. Winston. Absolutely. 

Mr. Plunkett. Senator, I would just add that then the con- 
sumer, at that point, once they get the notice, can look at the dif- 
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ference in the rate that is being offered, for example, if it is a slight 
increase in a credit card, and this consumer is inclined to pay their 
balances every month, then they do not request their report, they 
do not sweat it. But if it is a 3 percent difference on a mortgage 
loan, that can obviously be hundreds of thousands of dollars over 
the course of a 30-year fixed loan, then they are going to want to 
look at their credit report. Leave the decision to the consumer. 

Senator Sarbanes. Ms. Stewart. 

Ms. Stewart. We would just agree that it is very important for 
consumers to have the information so that they can make an in- 
formed decision. When it comes to mortgage credit, for example, 
the fact that they may get a notice that they are paying a slightly 
higher rate, if they do have truly damaged credit, might not be a 
bad thing. If they have credit extended to them at all, it might be 
a good thing. But it is not a good thing if they do not know, going 
into the process, that they may not have good credit or that there 
may be problems in their credit report that may lead to a higher 
interest rate. 

The reason that is important for them to know is that obviously 
the whole purpose of homeownership is not just to provide a shelter 
over your head. It is to provide a wealth-building opportunity. To 
the extent that they have to pay more in financing costs, it reduces 
that opportunity to build wealth over time, and therefore elimi- 
nates one of their biggest priorities in terms of acquiring a home 
and having and building home equity over time. 

Senator Sarbanes. Mr. Chairman, my time is up. It shows the 
complexity. One question and we run out of time. 

Chairman Shelby. Absolutely. 

Senator Bennett. 

Senator Bennett. Thank you very much, Mr. Chairman. I agree 
with Senator Sarbanes that this has been a very useful and inter- 
esting panel. 

I wish we had had some representatives of the industry that pro- 
vides credit scoring. I know Fair Isaac does, but I am talking about 
Equifax and the others, to address some reactions to some of the 
proposals that have been made. One of them that I would want to 
know is clearly cost. What is it going to cost to give a free credit 
report to everybody who asks for it? We have got some indication 
in those States where it is available now, but when I have asked 
that question of representatives of the industry, they say, well, it 
depends on the advertising campaign. I am not sure it is fair to put 
it on you, Mr. Plunkett, but groups say, get your credit report. 
They start advertising this. People say, you know, the cost is de 
minimis unless there is an advertising campaign whipping every- 
body up to please write in for their credit report. Then the number 
of credit reports goes up. The number of free credit reports goes up 
very dramatically. And the free credit report, while free to the indi- 
vidual, is not free to the credit bureau that is providing it. We 
might inadvertently go down the line of saying, gee, free credit re- 
ports for everybody is wonderful, and by the way, we have just 
added X amount of cost to the overall system which will then fall 
back on the consumer because ultimately the consumer has to pay 
the cost. 
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If any of you have any information about that, I hope you would 
furnish it to the Committee. 

Let me get specifically, Ms. St. John, to the area that you talked 
about that I found really fascinating and frankly, a little bit con- 
fusing. One of the concerns that I have, take your reference to the 
SAT scores as an analogy here, is that some overactive trial lawyer 
will try to turn the score into an entitlement. We have seen that 
with respect to colleges, of people saying, I have an SAT score of 
X. Someone else has an SAT score that is not as good as mine. The 
college made a choice to choose them for reasons other than just 
the score, and I am going to bring lawsuit saying I am entitled to 
that spot in this law school, or this university because my SAT 
scores were higher than his. 

You see the problem here. Now, you have indicated that a cus- 
tomer can choose the score by which he wants to be judges, as op- 
posed to the score that is widely distributed, and I need to have 
you explain that to me a little better. I do not quite understand 
that statement. 

Ms. St. John. Senator, your point is well taken. One of the 
things that we make very clear on the website and in the consumer 
booklets that we publish, is that the score is just one factor that 
lenders use in making their decision, and that lenders use a num- 
ber of different factors, depending on the type and the nature of the 
credit decision that is being made. 

Having said that, we recognize that there is a variety of different 
kinds of scores available. One of the biggest concerns that we actu- 
ally have with some of the score disclosure legislation that is in 
place today is that it simply requires disclosure of a score by the 
credit reporting agencies, not necessarily the one that is most wide- 
ly used. Consumers may not recognize that the score information 
they are getting in those States is not necessarily a widely distrib- 
uted score. In some cases, it may be a general consumer education 
score. It may be other scores that the credit reporting agencies dis- 
tribute. But the point that we were really trying to make is that 
we feel consumers are best served if they know and understand the 
scores that lenders are using. Lenders use a wide variety of scores, 
including a lot of custom, proprietary scores. But to the extent that 
there is a widely distributed score, we feel that is the most useful 
score for consumers to know and understand. 

Senator Bennett. Then why would a consumer say, well, I want 
to choose another score to be disseminated about me? If it is the 
most widely distributed score that people use, aren’t you de facto 
creating a national norm here? 

Ms. St. John. To the extent that there is a widely used score, 
I agree. We would think that that would be the default. However, 
recognizing that there are other generally available scores, there 
may be a general consumer education score, at the end of the day 
we feel that consumer choice, if they have the information to un- 
derstand the types of scores that are available, if they are allowed 
to at least choose the score most widely used, would serve them 
best. Today, in the State of California, consumers do not nec- 
essarily even have access to the score most widely distributed by 
all three credit reporting agencies. 



532 


Senator Bennett. My time is up, but I would like to come back 
to this on a second round if I could, Mr. Chairman. 

Chairman Shelby. Thank you. 

Senator Miller. 

COMMENTS OF SENATOR ZELL MILLER 

Senator Miller. Thank you, Mr. Chairman. 

I would like to thank the panel. I particularly would like to 
thank Ms. Gambrell for including that information about the 
Money Smart model site and the Dekalb workforce center in Geor- 
gia and also what is going on at Decatur High School. I did not 
know that until I read your testimony, and that is good work and 
I am glad you included it. 

I grew up in a home where the head of the household was a 
woman, and back in those days of antiquity, I can remember how 
she dreaded to go to the bank to try to borrow some money. Back 
then, a woman being the head of a household was a rarity. Of 
course today it is commonplace. I am wondering though, do we 
lump these women who head households under the title of con- 
sumer, that we use so freely, or should there be any kind of special 
effort to educate this group in particular somewhat better? Any- 
body have any thoughts on that? 

Ms. Gambrell. Senator, just some quick observations. I think 
certainly we have found at the FDIC that there are specific popu- 
lations that have an even greater need, and certainly the panelists 
have talked about that today. When you look at underserved com- 
munities, when you look at unbanked populations, there are in par- 
ticular groups within those categories: Minorities, women, those 
who are in low- and moderate-income categories. So as you look at 
the wide range, quite honestly, of financial education curricula, you 
will see that there are some very excellent programs that are 
geared specifically toward women, sometimes toward older women, 
sometimes toward women who are heads of household. That infor- 
mation is critical. It is crucial to help them understand how to get 
a foothold into the financial structure, how to better manage their 
money, and how to better manage their household. But I think we 
can all say certainly today that there continues to be the need for 
even greater education. And more than just education and aware- 
ness, that there has to be a link between that education and spe- 
cific products, services, and programs, so that as people move 
through the educational track, there is something on the other end, 
there is an incentive that will bring them into a bank, a financial 
institution, or to use other types of products and services that will, 
in essence, lift them from their current financial situation. 

Senator Miller. Thank you. 

Ms. Stewart. Senator Miller, we have done research at the 
Fannie Mae Foundation on issues around women and their comfort 
level with financial matters, and some of our research shows that 
women in general are less comfortable dealing with financial 
issues, less comfortable with financial terms like IRA’s, IDA’s, and 
other kinds of financial jargon. So, we believe at the Fannie Mae 
Foundation we have to do a particularly good job in reaching out 
to lots of different communities, and in particular to women, to 
help them better understand issues around financial literacy and 
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get them better prepared to manage their financial life for them- 
selves and their families. 

We know that the homeownership rates among women, single- 
family headed households are particularly low, but they are grow- 
ing. We believe there is a huge opportunity in this country if we 
invest more in education and information among women, that we 
will be able to do more to push the homeownership rate. 

One of the things that we found in terms of the delivery of finan- 
cial services information for lots of different groups, African-Ameri- 
cans, Hispanics, minority groups, and immigrants, is that if you 
present information in the language and in a way that they under- 
stand and feel comfortable with, you actually have more success in 
getting information through. For example, with the Native Amer- 
ican population, we have actually produced financial literacy infor- 
mation that is culturally specific to their population so that they 
can receive the information in a way that they feel comfortable and 
can understand. We think this can be tailored for women, as well 
as other groups that are particularly in need and are particularly 
underserved and overlooked by the financial services industry. 

Senator Miller. Thank you very much. I think they face a spe- 
cial challenge, and I am glad to hear there are some special pro- 
grams that try to zero in on this. 

I do not have any other questions, Mr. Chairman. 

Chairman Shelby. Thank you. 

Ms. St. John, just a quick question here, and then I will move 
on. Would it be fair to say that FICO scores can only be as good 
as the baseline information used to develop them, that is, accuracy 
is everything here, is it not? 

Ms. St. John. Yes. The FICO scores use all of the factors proven 
predictive of credit risk based on the credit reports information. 

Chairman Shelby. You need accuracy. You need the information 
in the report to do it right, don’t you? 

Ms. St. John. Well, you certainly need a base level of informa- 
tion for those scores to be predictive, definitely. 

Chairman Shelby. Right. 

Mr. Hildebrand, I assume that Capital One wants to have a good 
understanding about the credit history of its potential customers. 
In other words, your underwriters need information to make under- 
writing decisions like everybody that extends credit. 

Mr. Hildebrand. Absolutely. 

Chairman Shelby. So as consumers of information, you are fully 
supportive of its widespread availability? 

Mr. Hildebrand. Yes. 

Chairman Shelby. But as providers of information, you seem to 
have adopted a different perspective from what the staff has told 
us. They say you deliberately withhold furnishing to credit bureaus 
important customer information, information which has a material 
bearing on your customers’ eligibility for credit. Some have claimed 
that Capital One, your company, is gaming the system to prevent 
its customers from appearing like worthwhile marketing targets to 
your competitors in the marketplace. Do you think your customers 
know of, let alone understand. Capital One’s policy with respect to 
furnishing information to the credit bureaus? Quick answer. 
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Mr. Hildebrand. So you speak about our reporting of credit 
lines? 

Chairman Shelby. Yes, under reporting stuff. Our staff has 
said 

Mr. Hildebrand. One specific variable that has been cited is the 
reporting of credit lines, Senator. 

Chairman Shelby. You said you do that because if you report it 
all, then the customer might have a better shot in the market. 

Mr. Hildebrand. We have not seen any research yet that indi- 
cates that this is in any way impactful on consumers, we have 
agreed to team up with Fair Isaac to actually look into this. 

Chairman Shelby. But you do not deny doing it, I would hope? 

Mr. Hildebrand. No, no, we do not report customer’s credit line, 
that is correct. 

Chairman Shelby. Well, why don’t you report it, because accu- 
racy is so important? 

Mr. Hildebrand. It is a proprietary issue for us. At Capital One, 
one of the ways we manage risk, quite appropriately, is through 
the granting of credit lines, and the way that we manage that is 
called “credit line sloping.” We believe that is a competitive tool 
that we use better than anybody else in America. Our concern is 
that if we were to report that, our competitors could reverse engi- 
neer our credit policies and replicate that. It is an advantage that 
we have in the marketplace. 

Chairman Shelby. But on the other hand, what about accuracy? 
If I was doing business with you or anybody, I would want my re- 
port coming from Ms. St. John’s company or whoever does this, to 
reflect everything I have to be accurate. In other words, how can 
the other people determine the report that comes out to be accurate 
if you do not, as a creditor, furnish that information to the credit 
bureau or if you skew the information? 

Mr. Hildebrand. We do not yet 

Chairman Shelby. I know you do it for proprietary reasons, but 
the customers out there, which is all Americans, do not know that. 

Mr. Hildebrand. No, they do not. And as I said. Senator, we do 
not yet have any evidence that it actually has an impact on the ac- 
curacy of their credit score. If we receive that, we will certainly re- 
consider our policy. 

Chairman Shelby. But it could have some impact on whether or 
not the customers can go somewhere to shop for better. 

Mr. Hildebrand. That is possible. 

Chairman Shelby. Could it not? Sure. 

Mr. Plunkett, do you think the average consumer in America un- 
derstands that they can suffer negative consequences because a 
firm they have a credit relationship with decides to underreport in- 
formation regarding their credit history? 

Mr. Plunkett. Senator, the answer is no. Our survey shows 
that, we asked a specific question here, that the majority of Ameri- 
cans do not understand. 

Chairman Shelby. Do you think that the average consumer un- 
derstands that they may suffer, yes, suffer negative consequences 
because a firm they obtained credit from decides to underreport in- 
formation regarding their credit history, same fact? 
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Mr. Plunkett. Same answer, Senator. They do not understand 
they can suffer and this actually harms their overall credit score. 

Chairman Shelby. Would you agree that firms, that everybody 
that is in the marketplace, with credit so available, and accuracy 
so important, need to either furnish complete and accurate infor- 
mation to the credit bureaus or they need to inform their customers 
about their policy of limiting reporting? 

Mr. Plunkett. Senator, we think the first is absolutely essential. 
We need a requirement for complete reporting. As for informing 
customers on this one, this is an unethical practice. The experts on 
credit reporting and credit scoring tell us that it is very, very likely 
that this is a ding on the credit report. We know that if you look 
maxed out on your credit card, that is, you have a $500 balance 
and it looks like your credit line is $500, that that almost certainly 
is used as a negative factor in some way in calculating your credit 
score. Absolutely, it should be required that this information be re- 
ported. Telling consumers about it after the fact, I do not know 
that that helps them very much on this one, because the point of 
the whole credit reporting system is to have accurate and complete 
information. 

Chairman Shelby. Senator Sarbanes. 

Senator Sarbanes. Mr. Chairman, I want to take a moment or 
two to follow up on your line of questioning that you were pur- 
suing. I think it is important. 

Ms. St. John, in your statement you say that 30 percent of your 
FICO score is determined on the basis of amount owed. 

Ms. St. John. Yes. 

Senator Sarbanes. And you list as one of the factors under 
amounts owed proportion of credit lines used, proportion of bal- 
ances to total credit limits on certain types of revolving accounts. 
So you would look to see — maybe you have a $5,000 limit — whether 
you would use $500 of it or $4,500 of it. Is that correct? 

Ms. St. John. Yes. 

Senator Sarbanes. Okay. 

Ms. St. John. The amount of available credit line that is actually 
used and the balance owing been proven to be predictive factors. 

Senator Sarbanes. And the higher percentage of the available 
credit on a particular credit line a consumer is using could hurt 
their credit score. Is that correct? 

Ms. St. John. In general, the pattern that we see is the higher 
the percentage of the line utilized, the greater the risk of non- 
payment in the future, yes. 

Senator Sarbanes. How do you determine what a consumer’s 
credit limit is on any given line of credit? 

Ms. St. John. There are several different fields that are avail- 
able that vary by the different credit reporting agencies. Some have 
a specific credit limit amount. Others represent a high credit 
amount that has been reached. The scoring systems use a variety 
of information to determine that high credit amount. If the credit 
limit is missing, it may look to see if there is other information 
that is available that can be used that has been proven predictive 
in the calculation of that ratio. 

Senator Sarbanes. The credit limit reported by the creditor, is 
that where that information comes from, presumably? 
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Ms. St. John. Yes. 

Senator Sarbanes. All right. Now, is the creditor required to re- 
port that information? 

Ms. St. John. No. 

Senator Sarbanes. What happens if a creditor does not report a 
credit limit maximum for a particular credit line? 

Ms. St. John. It depends on the specific algorithm or the pre- 
dictive variable that is being calculated. In some cases, the vari- 
ables may default to a high credit amount or another field that is 
available. In other cases, it may bypass that particular account 
from the calculation altogether if it cannot contribute to the cal- 
culation overall. The end result is that the individual score for any 
given consumer in that situation could be higher or could be lower, 
depending on the ratio of credit used relative to the limits on all 
their other accounts. 

Senator Sarbanes. On the particular credit line, isn’t the highest 
amount charged reported as the maximum? 

Ms. St. John. Depending on the credit reporting agency, yes, the 
highest amount actually reported is 

Senator Sarbanes. So if the creditor did not report the maximum 
score, that could artificially depress a consumer’s credit score be- 
cause it would make it appear he had maxed out or was close to 
maxing out, when, in fact, that was not the case. Is that right? 

Ms. St. John. It actually depends on what the current balance 
is at the time relative to whatever the maximum balance may have 
been. If they are carrying a very low balance at the time relative 
to the highest amount reached historically on that file 

Senator Sarbanes. Let’s assume that 

Ms. St. John. — it could be lower. 

Senator Sarbanes. — the maximum balance they ever had was 
far short of what the credit limit was. So you could end up — let’s 
say my maximum balance has been $500. I have $400 on my card. 
My limit is $5,000. But I am going to get reported as though I am 
at 80 percent of my usable money, as I understand what you are 
telling me, rather than getting reported at 8 percent. Is that right? 

Ms. St. John. It actually depends on what the total limits out- 
standing are across all revolving trade lines and the total balance 
is across all. So it’s not calculated on an individual account or trade 
line basis, but across all revolving accounts on the credit report. 

Senator Sarbanes. If that is my only revolving account? 

Ms. St. John. If that is your only revolving account and is the 
maximum balance reached, then, yes, it would be lower. It would 
likely result in a higher calculation. 

Senator Sarbanes. Well, I just want to ask Mr. Hildebrand. Does 
Capital One report the maximums on the credit limits? 

Mr. Hildebrand. We do not report the credit limit, the credit 
line that has been granted. We report the amount outstanding. 

Senator Sarbanes. Yes, so the person, this hypothetical person 
I have been describing, would really get a black mark when they 
do not deserve it. Isn’t that the case? 

Mr. Hildebrand. To paraphase Ms. St. John, it depends on the 
broad spectrum of the credit that you are looking at as the score 
is developed. The score is developed looking at the entire credit 
profile coming from the bureau. 
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Senator Sarbanes. I understand that, but this is one factor in 
there. 

Mr. Hildebrand. It is one factor. 

Senator Sarbanes. As far as this factor is concerned, clearly a 
negative mark is going to register against the consumer when they 
do not deserve that negative mark. 

Mr. Hildebrand. Senator, there are other scenarios that could 
be constructed that it is just as positive for consumers. And that 
is the research we are trying to do, to understand the impact that 
this would have. We certainly do not want to do anything detri- 
mental to American consumers. We have a business to run as well. 
That is what we are trying to protect here. And so we have to bal- 
ance those two. Right now it is a voluntary system. 

Senator Sarbanes. Are you unique amongst businesses in fol- 
lowing this path? 

Mr. Hildebrand. I do not know. 

Mr. Plunkett. Senator, I can tell you from our survey and our 
study in December, from the Federal Reserve study in February of 
this year in which they looked at 248,000 credit reports. Capital 
One is likely not the only one using this practice. The Fed study, 
one of their conclusions, by the way, was that the use of this posi- 
tive information does overstate risk for particular consumers. 

The other point I would make is that one of the standard generic 
explanations that consumers get when they get that adverse notice 
we have been talking about is, “Proportion of debt to available 
credit.” That means this is one of the reasons why your credit his- 
tory, your credit report and your credit score, is not as high as it 
could be. 

Senator Sarbanes. I have used a lot of time on that, but I 

Chairman Shelby. It has been very informative. 

Senator Sarbanes. It is an important point. 

Chairman Shelby. Senator Bennett. 

Senator Bennett. Thank you. I think it is an important point as 
well, and I think we should dig a little further into it. 

Where it leads is where I am not quite sure I want to go, which 
is legislation laying out the requirement as to what the provider of 
information has to provide by law. Currently, it is entirely vol- 
untary, is it not? 

Mr. Hildebrand. Yes, it is. 

Senator Bennett. Now, everybody who participates in the sys- 
tem has a vested interest in seeing that the system works. And, 
therefore, you are going to be as cooperative as you possibly can in 
providing information that you think will help the system work. 

If legislation comes in and says, okay, we are going to determine, 
by the wisdom of Congress, that the following things must be re- 
ported by every provider, with fines or other kinds of punitive ac- 
tion taken by the Government against a provider that does not fill 
in every single aspect of the blank, it conjures up, for me, a world 
that I am not really comfortable with because it means the Govern- 
ment virtually has taken ownership of this process, and the next 
step, Mr. Winston, is that the FTC runs it. Fair Isaac goes out of 
business, the FTC is giving scores. Congress is mandating what 
will be considered and what will not. And I think somebody out 
there is going to figure out a way to game that and get around it 
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because this was not listed, so we can start to make decisions here, 
there, and everywhere. 

Am I overreacting? 

Mr. Plunkett. Senator, I would just respond to say we would 
not recommend that kind of micromanaging in the statute. There 
are obligations placed on credit bureaus and credit furnishers in 
the statute on accuracy. The statute is not explicit in terms of what 
is accurate and what is not. The agencies enforce it. We need an 
explicit standard on completeness, you know, just a definition, 
without micromanaging what is and what is not complete. We will 
leave that to the agencies. 

I will just add one more point. My understanding is that Fannie 
Mae and Freddie Mac require complete reporting, and I have not 
heard any reports that it has led to a problem in terms of people 
leaving the system. 

Senator Bennett. That is voluntary. 

Mr. Plunkett. When it comes to mortgage lending. 

Senator Bennett. That is voluntary. 

Mr. Plunkett. Yes, but it goes to your point that this kind of 
requirement would result in people fleeing, you know, furnishers 
fleeing the credit reporting system. What this shows us is that sce- 
nario probably would not happen. 

Senator Bennett. Could you furnish us with a list of the things 
you think should be required? 

Mr. Plunkett. In a definition of completeness? 

Senator Bennett. Right. 

Mr. Plunkett. Yes. Absolutely, Senator. 

Senator Bennett. Okay. We can take a look at that and get a 
reaction to it. 

You made mention earlier on, Mr. Plunkett, in one of your an- 
swers to opt in or opt out on the affiliate sharing issue, and we 
have not gotten into that issue with this panel. But since you made 
a mention of opt in or opt out, at least as you said it there was 
the implication that you really did not care one way or the other, 
just so long as the consumer has an opportunity at that particular 
point that the adverse action is triggered by something other than 
the present definition of adverse action, you would prefer to go in 
the direction of adverse action being defined as something less than 
the optimum rate. And at that point the consumer can say, well, 
I do not want my information shared with somebody in an opt in 
or opt out situation. 

I am pretty firmly in the opt out camp on this because I believe 
that if you have opt in, simple inertia will prevent the whole sys- 
tem from getting the information it needs. The analogy I give is if 
the phone book was opt in or opt out, you would probably have only 
about 20 percent of the phone numbers that are currently available 
to you in the phone book because the other 80 percent of the people 
would not get around to opting in. But if you do not want to get 
phone calls with the phone book, you can opt out and say I want 
an unlisted number. And I have discovered for those who say, yes, 
but an unlisted number costs money and I would prefer an opt out 
that is free, I have discovered it is very easy to get an opt out that 
is free, simply list your name in a way that nobody is going to rec- 
ognize but your friends and relatives. 
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My wife has an aunt who is listed by the initials, her first initial, 
then the initial of her maiden name and her married name, and 
nobody knows who she is in the phone book except her friends and 
relatives. Therefore, she has an unlisted number if somebody is try- 
ing to look for her, and it did not cost her anything. 

Could you address this question of opt in and opt out and what 
might very well happen if we go to an opt in and a large number 
of people say, well — not say, but by simple inertia stay out of it and 
thereby deprive affiliates of information that, in fact, can be, as we 
have heard in other panels, very, very useful to consumers? 

Mr. Plunkett. Senator, we support an opt in approach, but let 
me say this: Right now nationally, and at the State level, an opt 
in does not exist and an opt out does not exist. Neither exists for 
consumers regarding the sharing of this affiliate information. So ei- 
ther would be an improvement. 

We support the opt in approach because consumers again and 
again in polling have said that they are extremely concerned about 
the sharing of this information, this transaction and experience in- 
formation because we should respect that, and also because the in- 
stitutions you are talking about, even with an opt in, I have no 
doubt we are going to see a lot of marketing. The financial institu- 
tions in this country are masters of marketing. They are going to 
do everything in their power to explain the good purposes that they 
talk about for which this information is used. And so, even if it is 
an opt in, they are going to have their best shot at convincing con- 
sumers to use that opt. Consumers will have an opportunity to 
make that decision, to weigh the factors, and to decide whether it 
is worth their while to allow that information to be shared. 

Senator Bennett. My time is up. I would join you in supporting 
an opt out. I would suggest to you that the opt in process that you 
have described, which is a massive marketing plan to get those 80 
percent of the people who would not otherwise do it unless they got 
convinced, would be really quite expensive and raise costs for ev- 
erybody, and even if it were successful, end up hurting the con- 
sumer in higher costs for the services that were provided. 

Mr. Chairman. Thank you. 

Chairman Shelby. Senator Allard. 

STATEMENT OF SENATOR WAYNE ALLARD 

Senator Allard. Thank you, Mr. Chairman, I apologize I was not 
here at the start of the hearing, but I do have a full statement I 
would like to make part of the record. 

Chairman Shelby. It will be made part of the record in its en- 
tirety, without objection. 

Senator Allard. I hope this is not duplicative of a question pre- 
viously asked, but I would like to direct this to Ms. St. John. In 
your testimony, you explain that there are many different kinds of 
credit scores ranging from the Fair Isaac’s-developed, broad-based 
FICO scores, widely distributed to lenders, to custom models that 
are developed for use by individual lenders. The last kind of credit 
score you mention are those distributed primarily to the consumer 
market. I am curious how the credit scores distributed to lenders 
are different than those distributed to consumers. 
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Ms. St. John. In many cases, credit scores are being made avail- 
able to consumers in States that have required score disclosure. 
California was the first and Colorado has recently passed a law. 
We have cooperated with one of the credit reporting agencies to en- 
sure that the FICO scores are indeed provided to consumers in 
those States when they request them. That is not necessarily the 
case, though, with all the credit reporting agencies. It is really up 
to the credit reporting agency to simply provide a score which may 
or may not be the one that is actually the scores that lenders are 
using in a number of cases. 

As I mentioned in the written testimony, there are general con- 
sumer education scores that have been developed that describe 
scores in general and give an idea. There are scores that the credit 
reporting agencies have developed on their own that are propri- 
etary to those agencies. There is the FICO score. And then, of 
course, there are custom proprietary scores that the lenders would 
use that the credit reporting agencies would not have access to. 

Our point in our written testimony is simply that it is important 
when score disclosure comes up as a topic to be clear on what 
score. We certainly would indicate that the consumer’s knowing 
and understanding what scores lenders use and having access to 
the scores most widely distributed at a particular point in time is 
what would serve the consumers best. And at the end of the day, 
if there is a choice of different widely distributed scores, it puts 
consumers in charge by giving them the choice. 

Senator Allard. All those scores, though, impact decisionmaking 
by the lender, whether or not they are distributed to the consumer. 
Is that correct? 

Ms. St. John. They may or may not. My understanding is that 
generally developed consumer scores for consumer education pur- 
poses may not even be something that is provided to lenders or 
that lenders are using. I do not really know in many cases, and I 
think that is one of the biggest issues that we have found, that it 
is difficult for consumers to necessarily know what score they are 
actually being provided with. 

Senator Allard. Okay. So the score that the lender has is not 
necessarily comparable to that which has been provided to the con- 
sumer. Is that correct? 

Ms. St. John. That is correct in the sense that, again, there are 
many different kinds of scores that are available. And the best way 
to indicate if there is understanding and access to credit scores is 
by ensuring that if there is a widely distributed score, it makes 
sense that that would be the one that is provided most often as op- 
posed to, say, lenders’ own proprietary scores. As I indicated, the 
credit reporting agencies would not even have access to those. 

Senator Allard. We have three main credit bureaus, I guess is 
the best way to describe it. Do credit scores vary among those three 
credit bureaus? 

Ms. St. John. Yes, they do. 

Senator Allard. In what way? 

Ms. St. John. Well, the FICO scores, as we indicated, are the 
most commonly used. In fact, there are different underlying credit 
scoring algorithms at each of the three credit reporting agencies. 
The reason for that is because there are different underlying data 
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elements that are maintained by those credit bureaus, and Fair 
Isaac has sought to develop the most predictive scores available for 
each of those three credit repositories. 

We do scale them so that the same score represents the same de- 
gree of risk, regardless of which credit reporting agency it is ob- 
tained from. But the actual underlying statistical algorithms are 
slightly different between the three. 

Senator Allard. Mr. Chairman, I see my time has expired. 

Chairman Shelby. Thank you. Senator Allard. 

Ms. Smith, in your written testimony, you have highlighted that 
the development of risk-based pricing has reduced the number of 
adverse action notices, which is a key accuracy device that con- 
sumers receive. You also point out that, at present, there are sig- 
nificant questions as to the overall accuracy of credit reports. 

You then indicate that the outmoded adverse action notice should 
not be updated. This is troubling to me, and probably others. In 
other words, it seems to me if you are looking for accuracy rather 
than just making — and Senator Sarbanes, I believe, raised the 
question — them another offer, but always at a higher rate of inter- 
est, always, without them being jolted. 

Ms. Smith. Okay. I was not intending to suggest that this is an 
area that should not be looked at or should not be updated. 

Chairman Shelby. By “looked at,” you mean 

Ms. Smith. Considered as far as 

Chairman Shelby. This is the time to deal with it, isn’t it? 

Ms. Smith. Right. 

Chairman Shelby. Okay. All right. 

Mr. Winston, the FTC favors updating the adverse action notice 
process. Is that support for updating based on the notion that con- 
sumers will never be more aware of the need to review their credit 
report than after they have been jolted to that awareness by some 
kind of credit-related problem? 

For example, if I were to apply for a credit card with Capital 
One, or anybody, and 

Senator Sarbanes. Well, Capital One is at the table, so that is 
a good example. 

Chairman Shelby. It is. 

Mr. Hildebrand. And we appreciate you applying, too. Senator. 

[Laughter.] 

Chairman Shelby. I may have one from them. Who knows? 

Mr. Hildebrand. I hope you do. 

Chairman Shelby. But if I did, shouldn’t they have all the infor- 
mation that goes on me to evaluate my credit risk? Do you agree 
with that? 

Mr. Winston. Yes, that is the ultimate teachable moment. 

Chairman Shelby. Now, on the other hand, if they did not have 
all the accuracy, all the information, and they might not give me 
the credit card with the lowest rate of interest, they might make 
a counteroffer of 3 percent more interest, or whatever it is. But I 
still would not know why, would I? I would just know they made 
me a counteroffer. Is that correct? 

Mr. Winston. You would not know that this is a counteroffer, 
necessarily. You may not even know that there is a lower rate 
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available to people with better credit. They give you a number. You 
may think that is what they offer, that is their best rate. 

I think a lot of consumers do not understand this notion of dif- 
ferent rates for different credit risks. 

Chairman Shelby. Well — and I am speaking for myself — I think 
there should be different rates for different credit risks. 

Mr. Winston. Of course. 

Chairman Shelby. I mean, that is how the market works. You 
know, you have to have that, I believe. On the other hand, the ac- 
curacy of that credit report is key to all the scoring, is it not? 

Mr. Winston. Yes. I think the fact that there are different rates 
for different credit risks is a terrific thing. That is good for our 
economy. That is good for consumers. But that heightens the need 
for an accurate report, and it heightens the need for consumers to 
understand how that report is being used. 

Chairman Shelby. Absolutely. Thank you. 

Senator Sarbanes. 

Senator Sarbanes. This has obviously been a very interesting 
session. I wanted to just add an addendum to that last point. At 
some point for the different rates for different risks, we reach the 
point where the person is being called upon to pay rates that they 
cannot sustain by any reasonable measure. That is when we get 
into, in my judgment, predatory lending and similar practices. And 
it is one of the reasons I have been so concerned about that, be- 
cause beyond a certain reasonable point people are being led into 
a situation which is very apparent that this is well beyond their 
means to sustain. Usually that happens when there is real estate 
that can then be stripped away from them, so this wealth-building, 
whatever was done in the equity, is all taken out away from the 
people. So, I just want to add that extra dimension to it. 

I am not clear on the answer to Senator Allard’s question, which 
I thought was a good line of questioning. As I understand, it is pos- 
sible, under the way the current system works, that a creditor can 
deny me credit as a consumer. I get an adverse notice. I ask for 
the credit report to see what went wrong. And the credit report 
that I am given is different from the credit report used by the cred- 
itor to deny me credit. Is that correct? 

Ms. St. John. Senator, I was speaking in the case where it was 
proactive — a request by the consumer to obtain a copy of their cred- 
it score from a credit reporting agency. I think there are others on 
the panel who are better equipped to address the situation in the 
case of an adverse action, when an adverse action has been taken. 
Lenders have always been provided with the top reasons behind 
the score in order to provide the key underlying reasons for that 
adverse action to the consumer. 

Senator Sarbanes. Well, but that may be reformulated by the 
creditor. I want to know whether, if I am a consumer and I get an 
adverse notice, I ask for my credit report, whether I am going to 
get exactly what the creditor got when he denied me credit. 

Mr. Plunkett. Senator, here is a circumstance where that could 
happen. The creditor only submits a couple of points of identifying 
information on the potential — on the applicant, on the consumer: 
Name, Social Security number. We know that the system is imper- 
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feet and that it pulls up information that does not always pertain 
to that particular person. 

The consumer, when they ask for their report, they use four or 
five pieces of identifying information. So the credit bureau gets it 
right. The consumer gets the right information for them. But the 
creditor’s report may contain mixed files. It may contain informa- 
tion about John Smith, Sr., instead of John Smith, Jr. And the in- 
formation then used by the lender to make a credit decision is 
wrong, is inaccurate. 

That is why the consumer needs to see, in the case of an adverse 
action, that actual report that the lender used. 

Senator Sarbanes. Yes. 

Mr. Hildebrand. May I, Senator? 

Senator Sarbanes. Yes, certainly. 

Mr. Hildebrand. As a lender here, the case that Mr. Plunkett 
just cited could indeed happen, although the credit bureaus and all 
the lenders strive to make sure that the individual who has applied 
to us is the one whose credit record we are pulling. And there are 
mountains of information and pieces of technology that are used to 
do that. 

When an adverse action is issued, what we are trying to do 
there — we receive a large amount of information about a consumer 
electronically, machine-read, virtually unintelligible to a human, 
when those credit records are passed. So when we actually ask a 
bureau for a record so that we can approve an application, it comes 
in a format that is readily available to computers, not easily deci- 
phered by people. 

The report that is issued to a consumer out of the credit bureaus 
puts that into understandable language and context. The adverse 
action letters do the exact same thing. 

We may be looking at large amounts of information, but the sa- 
lient points, the reason for the issuance of the adverse action letter 
is really what is important to the consumer. It is that they, you 
know, have had too many late payments, for instance. That is why. 
The specifics of what we looked at and all those things, that is 
available on the report, but it is made in a format that is much dif- 
ferent than what we see. 

Senator Sarbanes. Of course, Mr. Plunkett posits a situation in 
which the consumer is being denied credit on the basis of a faulty 
report. 

Mr. Hildebrand. And as I said, that is a very rare circumstance. 

Senator Sarbanes. Well, it should not occur at all, presumably. 

Mr. Hildebrand. Agreed, and the credit bureaus, that is what 
they spend most of their time trying to do, is make sure that, you 
know, we do not walk around with identifying numbers that sort 
of — ^you know, a national security identification number that we 
use readily that makes all that information easy to capture and 
compile. That is what they spend their time doing. 

Senator Sarbanes. All right. Let me ask, Ms. Smith, in your tes- 
timony you speak of the efforts at the Federal Reserve to promote 
enhanced financial education. Ms. Gambrell and Mr. Winston also 
spoke of their agencies’ efforts. And it is my understanding — in 
fact, knowledge — that many other agencies, departments, and regu- 
lators have financial literacy and education initiatives underway. 
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Of course, there are extensive efforts at the State and local level, 
in the private sector, and by the nonprofit community as well. 

It is my strong view that there is a lack of coordination with re- 
spect to all these efforts, and particularly amongst the various Fed- 
eral agencies. I think we need a comprehensive strategy to promote 
financial literacy and education for all Americans. 

Do you think that increased coordination between the various 
Federal entities who are working on this problem, along with 
strong cooperation with State and local governments and nonprofit 
and private entities, to develop and implement a coordinated strat- 
egy would be a beneficial undertaking? 

Ms. Smith. It certainly would be valuable to coordinate and col- 
laborate in terms of having the agencies know what each of the 
others is doing. Generally, some of this is already taking place in 
the sense that I know that in the case of the Federal Reserve, 
when we enter into the financial education arena, we look at where 
it is that the Federal Reserve can add value rather than approach- 
ing it from ground zero and thinking that we need to produce bro- 
chures or that we need to produce programs. 

We, for example, would not attempt to replicate what the FDIC 
is doing, knowing the wonderful job that they have done with their 
Money Smart program. So that what we do attempt to do within 
the Federal Reserve is to see where there are segments of the pop- 
ulation where we might add value, so that, for example, some of 
our Federal Reserve districts, if they have Native American popu- 
lations, have placed their efforts there, not in the sense of edu- 
cating them necessarily in a direct sense, but working with Native 
American tribes, partnering with banking organizations and with 
community groups to bring the different elements together and to 
leverage resources. 

Senator Sarbanes. Ms. Gambrell, do you think we need a coordi- 
nated strategy? 

Ms. Gambrell. Senator, I would support and the FDIC would 
support a stronger coordination of financial literacy efforts, and 
certainly at the FDIC we have seen from our own efforts the impor- 
tance of the grass-roots collaboration with community organiza- 
tions, with financial institutions, and others. There are, as I said 
earlier, excellent programs out there, and we certainly see the ben- 
efit to an even more structured and strong coordination among the 
programs. 

Senator Sarbanes. Mr. Winston. 

Mr. Winston. Coordination is certainly a good thing. There is a 
lot of it that goes on now. I agree with Ms. Smith. And what we 
have learned in our educational efforts generally is that consistency 
of message is critical, that everybody be saying the same thing, be 
on the same page. And the more we can do that, the better. 

Senator Sarbanes. Ms. Stewart, do you want to add anything? 

Ms. Stewart. We think the coordination would be very impor- 
tant. But one thing I would just add to it is that one of the other 
important institutions to include in that conversation would be the 
public education system. One of the things that we found in re- 
searching the likelihood of consumers to even seek out financial lit- 
eracy information is that it usually comes when there is a crisis 
going on, when there is an important goal that a family may want 
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to reach, like homeownership or some other goals, or when a family 
has to comply with some requirements or some regulations. I dare 
say that I think for some younger people, younger Americans who 
need access to more information on financial literacy, a require- 
ment of school would prompt them to actually learn more about fi- 
nancial literacy. Actually, we would be able to do more in terms of 
increasing the understanding of credit and financial literacy to edu- 
cate people younger in their lives, so that before they get through 
college and certainly when they start working in the workplace, 
they have a much better understanding of how to establish good fi- 
nancial practices for themselves that will start them on the path 
to creating wealth and building wealth over time. 

Senator Sarbanes. Good. Thank you. 

Chairman Shelby. Senator Bennett. 

Senator Bennett. Thank you, Mr. Chairman. 

Back to this issue of score disclosure, Ms. St. John, I have gone 
into it and Senator Allard has gone into it. You are aware, of 
course, that what you are proposing here is different from what the 
House bill suggests and different from what is being done in both 
Colorado and California, where the credit reporting agency has lati- 
tude to choose. You have talked about latitude on the part of the 
consumer to choose, and I am still not quite sure I understand how 
that works here. The experience in the States that have this is the 
experience that the House bill has adopted, which means that the 
credit reporting agency can choose between the widely used scores, 
which presumably is yours — and I can understand you have a 
brand you would like everybody to use. But either that or edu- 
cational scores, which in their view might go farther toward help- 
ing the consumer understand why an adverse action was taken. 

I will not ask you to say, gee, we prefer somebody other than our 
company to be the one that is chosen, but this whole question of 
latitude, if I understand your testimony, you think the customer 
should make the decision as to which score he gets rather than the 
credit reporting agency being permitted to determine which score 
they give. 

Ms. St. John. That is correct. We feel the information is out 
there about scoring in general. It is a matter of simply trying to 
get the word out. In some cases, though, we feel like what is pro- 
posed under the House bill, if it follows what some of the States 
are doing could actually be confusing or misleading. It has been de- 
bated well, is it the score most widely used at any given time? That 
may or may not be the FICO score at some point in the future. A 
general education score that could be more valuable. 

At the end of the day, we simply feel that if the consumer had 
sufficient information to understand, they could choose, and at 
least have the right to be able to get the score that lenders are 
using widely at any given time. So what we were trying to propose 
was simply more flexibility in some of the wording or the language 
that would allow for greater consumer choice, and at least allow ac- 
cess to the score that is widely used by lenders at any given time. 

Senator Bennett. Okay. Not to prolong it, my problem is that 
many times the score may be the most widely distributed score, but 
it is not the score that a particular lender uses, in which case the 
customer is getting a score that is irrelevant to the fact that he has 
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had an adverse action from that particular lender. And, you know, 
that becomes more confusing. 

Let me just close my comments here — we have got a vote coming 
up — to put into the record, not to ask any particular question or 
raise any particular issue, but just put into the record that I think 
might help in our perspective of this. The FDIC is responsible for 
ensuring compliance at 5,400-plus FDIC-insured, State, non- 
member banks, literally millions and millions of consumers. I think 
the following set of numbers is interesting. 

In 2000, the FDIC received a total of 600 Fair Credit Reporting 
Act complaints and 194 inquiries. When they examined the 600 
complaints, 90 percent, 540, were found not to involve an error; 
only 60 were found to have involved an error or violation. So think 
of the millions of transactions that took place. Out of those mil- 
lions, 600 produced something that somebody decided they wanted 
to complain to the Federal agency about, and out of that 600, 60 
were found to involve an error. That was in 2000. 

In 2001, the FDIC received 100 complaints, down from 600 to 
100, and of them, 65 percent — easy, the raw numbers — 65 were 
found not to have involved an apparent bank error violation. 

In 2002, the FDIC received a total of 452. We got off the round 
numbers in 2002. Of these, 391, or 86 percent, were found not to 
involve an apparent bank error or violation; only 61, or 14 percent. 

That does not mean this is a trivial issue, and that does not 
mean we should not be having this hearing and looking at it as 
carefully as we are. But it does mean that the Fair Credit Report- 
ing Act is performing an awful lot better than some of the rhetoric 
around it might suggest. And we should be very careful, Mr. Chair- 
man, as we draw up the specifics of this legislation, to fix some of 
the problems that have been outlined here. I am particularly in- 
trigued by Mr. Winston’s suggestion that we change the definition 
of adverse action when a credit report is triggered. I agree with you 
that is a teaching moment. And the fact that I am not getting the 
best rate that I could have otherwise have gotten might be the time 
that it gets my attention. I would prefer Qiat to be the trigger of 
the free report than an advertising campaign to be the trigger of 
a free report. 

But as we go through all of these possibilities, we should remem- 
ber that this process has served America extremely well, has 
served minorities and those who are economically disadvantaged 
extremely well, has served entrepreneurial activity on the part of 
those who could not otherwise get credit to start businesses ex- 
tremely well. And we should be very careful not to mess up a good 
thing while we are in the process of trying legitimately and prop- 
erly to make it better. 

Chairman Shelby. Senator Allard. 

Senator Allard. Thank you, Mr. Chairman. Just briefly, I am 
just curious to know, of those of you who provide financial literacy 
information, do you also provide information on how to improve 
your credit score? 

Mr. Winston. Yes. 

Mr. Plunkett. Yes. 

Senator Allard. How many? All of you? 

Ms. Gambrell. We do. 
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Senator Allard. Let’s see. I see four out of seven? Five out of 
seven? Okay. And obviously you think this is an important follow- 
up on a credit score. 

When you talk about how a consumer can improve their credit 
score and then discuss their credit report, do consumers under- 
stand the difference? 

Mr. Plunkett. Well, funny you ask. Senator. We just did a sur- 
vey on this. We found that only a quarter of consumers had seen 
their credit score — this does not go exactly to your question — and 
that just under 50 percent had looked at their credit report. So we 
can assume for the rest of the population that they may not under- 
stand the difference. In fact, I mentioned this earlier. A small per- 
centage of consumers think the credit score actually measures their 
knowledge of credit as opposed to their creditworthiness. 

Senator Allard. Interesting. 

Ms. Gambrell. Senator, we certainly have found, as well, that 
in the Money Smart classes that we have taught, there are ques- 
tions that are raised by those participants. And, in fact, one of our 
modules actually walks people through a credit report to help them 
better understand what they need to look at, and in many of those 
classes, they have the reports right in front of them. But, clearly, 
there is still some confusion over the differences between that cred- 
it report and the credit scoring and how it may impact a person’s 
credit history. 

Ms. St. John. And if I could, for those who have visited 
myfico.com and actually purchased the basic service, which is their 
FICO score, the underlying credit report, and a detailed expla- 
nation of the factors that go into it, as well as some general advice 
as to how they can improve their score over time, we have had over 
3 million customers who have purchased that basic service, and 
they understand the difference from the standpoint that they can 
see their score, but then go back and forth between the score 
explaination and the underlying credit report. And many of the sta- 
tistics that we have gathered where we have surveyed visitors to 
myfico.com have indicated that over 80 percent have taken steps to 
try to improve their credit score over time following that, and 
roughly 80 percent would continue to monitor their score at least 
once a year. At least for those people that have visited the site, and 
gotten that information, including both the score and the report, it 
is quite clear what the differences are. 

Senator Allard. Yes, ma’am. 

Ms. Stewart. I would just add to it that our consumer education 
brochures on credit give general advice on how one can improve 
one’s credit score, credit profile, or credit report in general. But we 
do not feel that we have the information that would provide specific 
advice to a consumer on specifically the things that would drive a 
credit score up. We just give general advice that would improve 
one’s credit profile altogether. 

Senator Allard. I would suspect that most of you, if you get an 
adverse action, somebody applying for credit who got turned down, 
you would recommend to them at some point in time to come back 
and get another credit report to see if their credit history is accu- 
rately reflected. Under current law, consumers are provided one 
free credit report. If there is adverse action determined and they 
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correct it, do they have to pay for that second follow-up to see if 
that correction is there? 

Mr. Winston. Yes, except in those States where it is free. 

Senator Allard. Oh, some States provide that free of charge? 

Mr. Winston. Colorado is one. 

Senator Allard. Colorado is one of those. 

Senator Sarbanes. How many such States are there? 

Mr. Winston. I believe there are six. 

Ms. Stewart. Senator Allard, one other thing that I would just 
add to that is we actually advise in our outreach material that peo- 
ple actually get their credit report before they even enter the proc- 
ess and that people understand their credit profile before they ac- 
tually apply for a mortgage so that they do not get down the road 
and have to face a situation where they may end up having to pay 
more for a mortgage that may actually reduce their wealth-building 
opportunity. And so we actually advise people to even start the 
process with looking at a credit report before even applying for the 
mortgage in the first place. 

Senator Allard. Thank you, Mr. Chairman. 

Chairman Shelby. I want to thank all of you for being here 
today. I think this has been a very important and lively hearing. 

Senator Sarbanes. I agree with that, Mr. Chairman. 

Chairman Shelby. This hearing is adjourned. 

[Whereupon, at 12:22 p.m., the hearing was adjourned.] 

[Prepared statements and response to written questions supplied 
for the record follow:] 
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PREPARED STATEMENT OF SENATOR MICHAEL B. ENZI 

Mr. Chairman, I commend you for holding this important hearing today. 

Our credit market has been extremely important to the health of our economy. 
During the past few weeks, many individuals before our Committee have discussed 
that it is vital for consumers to understand the credit process before getting in- 
volved and the consequences that happen when people do not. In an ideal world, 
the primary tools of financial literacy would be taught to children at a very young 
age. I firmly believe that the fundamental basics of how to save, to invest, and to 
put money away for retirement are more important now than ever. 

There is a tremendous amount of excellent information out there, both in the pub- 
lic and private sectors, to help consumers comprehend how to handle money and 
credit. However, I also recognize that consumers can get confused easily by all of 
the information that is available, especially when tr3ring to determine what informa- 
tion is right for a particular consumer. To help in the process. Senator Stabenow 
and I will be introducing legislation this week to help give consumers an entry point 
for this information within the Federal Government. 

Whether a consumer is searching for financial information about starting a sav- 
ings account, to open a credit card, to start investing in the stock market, to pur- 
chase a home, or to put away money in a retirement account or pension plan, all 
consumers should have all of the information at their fingertips without having to 
hunt down specific information for just one purpose. We hope that this bill will help 
the Federal Government bring the right information, in the proper perspective, in 
one spot for consumers. 

As we will hear today, there are many excellent Federal programs and public/pri- 
vate partnerships out there. We just have to make sure that people can find them. 

I also want to single out Senator Sarbanes for all his hard work on financial lit- 
eracy. I know that he has worked very hard over the years, as Chairman and as 
ranking member, to bring this issue to the forefront. Mr. Chairman, I am very 
grateful that you also are making financial literacy a part of the Committee’s over- 
view of the Fair Credit Reporting Act. I look forward to working with you and Sen- 
ator Sarbanes and other Members of the Committee on this important issue. 


PREPARED STATEMENT OF SENATOR WAYNE ALLARD 

I would like to thank Chairman Shelby for holding this hearing on consumer 
awareness and understanding of the credit granting process. There are certain re- 
sponsibilities a consumer has in finding out the status of his or her credit, by pur- 
chasing or retaining a credit report. However, customers are often not aware of the 
factors that inhibit or enhance their ability to receive credit. Regulators and the 
credit industry have an important role to play in making sure that consumers are 
educated on the factors that determine their credit status, and what steps they can 
take to improve their credit score. 

Maintaining a good credit report is essential as it can determine a customer’s abil- 
ity to get a mortgage, a car loan, or insurance. Senator Schumer and I recently in- 
troduced S. 1370, the Consumer Credit Score Disclosure Act of 2003. This bill would 
provide consumers with their numerical credit score and an explanation of the fac- 
tors that determined that score when they apply for a mortgage or a loan. S. 1370 
would ensure that customers are made aware of their credit score, how it was cre- 
ated, and what they can do to repair it. Our bill would ensure that consumers have 
the tools they need to ensure they are getting the best rate and terms when apply- 
ing for financing. 

Thank you again, Mr. Chairman for convening this important hearing. I would 
like to thank the witnesses for agreeing to testify today, and look forward to your 
testimony. 


PREPARED STATEMENT OF DOLORES S. SMITH 

Director, Division of Consumer and Community Affairs 
Board of Governors of the Federal Reserve System 

July 29, 2003 

Mr. Chairman and Members of the Committee, I appreciate the opportunity to 
testify on the significance of maintaining a reliable national credit reporting system, 
the importance of the Fair Credit Reporting Act to that system, and the need for 
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consumer awareness of how this system functions and relates to their ability to ob- 
tain credit. 

Background and Overview of the Fair Credit Reporting Aet 

Background 

In the past, local banking institutions knew the credit capacity of individuals in 
their community. As the financial services industry has grown larger, financial prod- 
ucts and services more complex, and the U.S. population more mobile, it is no longer 
feasible for institutions to evaluate the credit standing of consumers based solely on 
their direct experiences with such consumers. Centralized credit bureaus, or con- 
sumer reporting agencies, have evolved to provide a repository of credit history 
information that can be accessed by creditors to evaluate the creditworthiness of 
prospective borrowers. This national credit reporting system provides creditors with 
an efficient, competitive, and cost-effective method of obtaining data for credit deci- 
sionmaking and consumers with increased credit availability. 

The data on what consumers understand about the credit granting process, and 
how their credit report relates to that process, are limited. There is some anecdotal 
evidence consumers are generally aware of the terms “credit scoring” and “credit 
rating,” but that they are not clear on how credit scores are used in credit granting. 
Because information obtained through the national credit reporting system has be- 
come invaluable to creditors in determining the creditworthiness of consumers, it is 
crucial that consumers understand how this system operates and impacts their abil- 
ity to obtain credit and the pricing of credit. Educated consumers who make in- 
formed decisions about credit are essential to an efficient and effective marketplace. 
Consumers who understand how their credit-risk profile relates to credit rates and 
terms can better determine which credit product suits their needs. 

Today, each of the three national consumer reporting agencies — Experian, 
Equifax, and TransUnion — maintains records on as many as 1.6 billion credit ac- 
counts held by approximately 190 million individuals. Each of the consumer report- 
ing agencies receives more than 2 billion items of information per month and issues 
roughly 2 million credit reports each day.i 

The information that is gathered by the consumer reporting agencies is obtained 
from banks, savings associations, credit unions, finance companies, retailers, other 
creditors, and collection agencies, as well as from public records. A consumer report 
generally consists of five types of information: Identifying information, such as the 
consumer’s name and address; detailed information reported by creditors regarding 
individual credit accounts; public record information, such as records of bank- 
ruptcies, foreclosures, and teix liens; information reported by collection agencies, 
mostly regarding nonpayment of bills; and information regarding inquiries about a 
consumer’s credit record. Consumer reports are used for credit, insurance, employ- 
ment, and certain other limited purposes. 

Overview of the Fair Credit Reporting Act 

The Congress adopted the Fair Credit Reporting Act (FCRA) in 1970 to regulate 
credit reporting systems in the United States, and passed significant amendments 
in 1996. The primary purposes of the FCRA are to ensure fair and accurate credit 
reporting and to protect consumers’ privacy. Among other things, the FCRA imposes 
certain obligations on consumer reporting agencies, on users of consumer reports, 
and, since 1996, on furnishers of information. 

A person may obtain a consumer report only for a permissible purpose. The FCRA 
specifies the permissible purposes, which include using the information contained 
therein for a transaction involving an extension of credit to a consumer. If a creditor 
takes any action that is adverse to a consumer based on information in a consumer 
report, the creditor generally must give the consumer a notice of the adverse action. 
This notice informs consumers about their rights under the FCRA. 

Participation in the U.S. credit reporting system is voluntary. Creditors are not 
required to obtain consumer reports before making credit decisions, although most 
creditors rely on consumer reports for risk-management purposes. Creditors also are 
not required to furnish information to consumer reporting agencies. But if they do, 
the information they furnish must be accurate. They must correct and update erro- 
neous information, and must investigate any disputed information. 

Consumer reporting agencies have extensive responsibilities under the FCRA. 
Those responsibilities include: Maintaining reasonable procedures to ensure that 
consumer reports are furnished only to persons having a permissible purpose; fol- 
lowing reasonable procedures to ensure the meiximum possible accuracy of consumer 


^See “An Overview of Consumer Data and Credit Reporting,” Federal Reserve Bulletin, Feb- 
ruary 2003, at 49-50. 
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reports; reinvestigating the accuracy or completeness of any disputed information 
and notifying the consumer of the results of the reinvestigation; omitting certain ob- 
solete information from consumer reports after specified periods of time; and pro- 
viding consumers with a copy of their consumer reports upon request. 

The FCRA contains important consumer rights and protections. Several are de- 
signed to promote accuracy in consumer reports. For example, the right to receive 
notice if information in a consumer report has resulted in adverse action enables 
consumers to check the accuracy of information in their credit reports. An adverse 
action notice must inform the consumer of the name, address, and telephone num- 
ber of the consumer reporting agency that furnished the report, the consumer’s right 
to obtain a free copy of the consumer report, and the consumer’s right to dispute 
the accuracy or completeness of any information in the consumer report. Consumers 
have a right to obtain a copy of their consumer reports, upon request; currently this 
right does not extend to getting their credit score.^ Consumers also have the right 
to dispute the accuracy or completeness of any information in their consumer re- 
ports with a consumer reporting agency, to have such information deleted or cor- 
rected, and to have a statement of dispute included in the report if the dispute is 
not resolved. Consumers may also dispute the accuracy of items with the furnisher 
of the information. 

Other consumer rights and protections are designed to protect consumer privacy. 
Consumers have a right to be excluded from prescreened solicitation lists. The three 
national consumer reporting agencies maintain a toll-free telephone number that 
consumers can call to exercise this right. Limiting access to consumer reports to per- 
sons that have certified a permissible purpose under the FCRA also protects con- 
sumer privacy. In general, the FCRA restricts the sharing of certain information 
among affiliates unless the consumer is given the opportunity to opt out of that 
sharing. Additional privacy protections apply in circumstances where consumer re- 
ports are provided to prospective employers or contain medical information, and 
where investigative consumer reports are prepared or obtained. 

The Importance of the National Credit Reporting System 

Maintaining a reliable national credit reporting system is essential to ensure the 
continued availability of consumer credit at reasonable cost. As Federal Reserve 
Board Chairman Greenspan has observed, “unless we have some major sophisti- 
cated system of credit evaluation continuously updated, we will have very great dif- 
ficulty in maintaining the level of consumer credit currently available[.]”® Without 
the information that comes from various credit bureaus and other sources, lenders 
would have to impose higher costs on consumers to compensate for the increased 
risk and uncertainty associated with the credit they extend. 

The readily availability of accurate, up-to-date credit information from consumer 
reporting agencies benefits both creditors and consumers. Information from con- 
sumer reports gives creditors the ability to make credit decisions quickly and in a 
fair, safe and sound, and cost-effective manner. Consumers benefit from access to 
credit from different sources, the competition among creditors, quick decisions on 
credit applications, and reasonable costs for credit. 

The Importance of Credit Scoring 

Credit scoring has become an important tool in the credit granting process. Credit 
scoring models, which typically are proprietary to individual institutions or indi- 
vidual consumer reporting agencies, use credit bureau information and other data 
to construct mathematical scorecards that can accurately predict levels of credit- 
worthiness across various populations. These models assign positive and negative 
weights to items of information that have demonstrated statistical usefulness for the 
evaluation of credit risk. Credit scoring enables creditors to evaluate, quickly and 
inexpensively, the risk of lending to credit applicants, and promotes the making of 
expedited credit decisions in a safe and sound manner. Consumers benefit from the 
increased availability and lower cost of credit made possible by the use of credit 
scoring models. Credit scoring also may help to reduce unlawful discrimination in 
lending to the extent that these systems are designed to evaluate all applicants ob- 
jectively and thus avoid issues of disparate treatment. 

As Chairman Greenspan has noted, the emergence of credit scoring technologies, 
“has proven useful in expanding access to credit for us all, including for lower-in- 


2 A credit score is a numerical representation of a consumer’s overall credit profile arising 
from mathematical procedures that weight attributes in the way that hest distinguishes between 
preferred and not preferred accounts. 

3 Remarks following prepared testimony by Alan Greenspan, Chairman of the Board of Gov- 
ernors of the Federal Reserve System, April 30, 2003, House Financial Services Committee. 
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come populations and others who have traditionally had difficulty obtaining credit. 
It has also enabled financial institutions to offer a wide variety of customized insur- 
ance, credit, and other products.”"* Chairman Greenspan stressed the importance of 
maintaining a system that provides incentives to develop more sophisticated credit 
scoring models and enables credit scoring models and technologies to advance.® 

Risk-Based Credit Pricing 

Credit evaluation systems rely on information gathered by consumer reporting 
agencies on consumers’ borrowing and payment experiences to measure the credit 
risk posed by current and prospective borrowers. Risk-based pricing, which has be- 
come increasingly common in all sectors of the credit industry, is a mechanism by 
which the rates offered or charged to consumers reflect the creditworthiness and 
risk posed. Risk-based pricing is made possible because creditors have available to 
them data from consumer reports, including credit scores, which permit them to 
assess the risk profiles of individual consumers. For example, a consumer dem- 
onstrated to have an extremely low risk of default or delinquency, based on a con- 
sumer report, would likely be offered a very favorable interest rate; a consumer with 
a marginal credit history, on the other hand, may also be offered credit, but at a 
higher rate. Risk-based pricing permits creditors to offer credit products tailored to 
the consumer’s individual risk profile. 

The Importance of the FCRA to the National Credit Reporting System 

Federal Preemption Under the FCRA of Certain State Laws 

In 1996, the Congress amended the FCRA and, among other things, preempted 
the States from enacting laws or regulations dealing with seven areas addressed by 
the FCRA. These seven areas include: The procedures for using prescreened solicita- 
tions; the time for reinvestigating disputed information; the duties of creditors that 
take adverse action; the informational contents of consumer reports; the duties of 
furnishers of information; affiliate information sharing; and the form and content 
of the summary of rights disclosure. Through these preemption provisions, the Con- 
gress effectively established uniform national standards in these areas. The FCRA 
preemption provisions are scheduled to sunset on January 1, 2004. After that date. 
States would be permitted to enact laws in these seven areas if those laws explicitly 
provide that they are intended to supplement the FCRA and give greater protection 
to consumers than is provided under the FCRA. 

Chairman Greenspan has stated his support for making permanent the provision 
currently in the FCRA to provide for uniform Federal rules. In an appearance before 
the House Financial Services Committee earlier this year, Chairman Greenspan 
spoke of the importance of having “national standards” under the FCRA, and cau- 
tioned that with significant differences State by State, it would be very difficult to 
maintain as viable a system as we currently have. 

The FCRA promotes the national credit system in important ways. Perhaps most 
significantly, the availability of standardized consumer reports — that contain nation- 
ally uniform data — allows banks to make prudent credit decisions efficiently wher- 
ever they do business and wherever their customers live and work. The FCRA’s 
national standards governing furnisher responsibilities and duties of users taking 
adverse action — the two primary areas of responsibility for most financial institu- 
tions — promote efficiency by enabling banks to comply with a single set of rules for 
all of their domestic credit operations. State-specific restrictions on furnishing infor- 
mation to consumer reporting agencies, or on the contents of information contained 
in consumer reports supplied by consumer reporting agencies, could negatively af- 
fect credit availability and increase the cost of credit. 

Accuracy of Consumer Reports 

Although maintaining uniform Federal rules in the seven areas where the FCRA 
currently preempts State action is essential to the national credit system, the cur- 
rent system is by no means perfect. In particular, concerns have been raised about 
the accuracy and completeness of information in consumer reports. Recent studies 
have shown that consumer reports sometimes contain inaccurate, incomplete, or 
inconsistent data, although the degree to which this is a problem is in dispute.® 
Moreover, the growing problem of identity theft only heightens concerns about the 


* Letter from Chairman Alan Greenspan to Congressman Ruben Hinojosa, February 28, 2003. 
® Remarks following prepared testimony by Alan Greenspan, Chairman of the Board of Gov- 
ernors of the Federal Reserve System, July 15, 2003, House Financial Services Committee. 

®For a summary of these recent studies, see “An Overview of Consumer Data and Credit Re- 
porting,” Federal Reserve Bulletin, February 2003, at 50. 
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accuracy of consumer reports, because of the difficulties that victims often face in 
having fraudulent accounts removed from their credit files. 

The accuracy of consumer report information is a critical element of the national 
credit reporting system. Most of the problems associated with consumer reporting 
agency data appear to result from the failure of creditors, collection agencies, or 
public entities to furnish complete and consistent information in a timely manner.'^ 
Four particular areas of concern with regard to consumer report accuracy include: 
(1) The failure to report credit limits; (2) the failure to report updated information 
on accounts; (3) the failure to report nonderogatory accounts or minor delinquencies; 
and (4) the inconsistent reporting of public record data, collection agency data, and 
inquiries.® Although the financial services industry has undertaken efforts to ad- 
dress the problem of inaccurate (and incomplete) information in order to deter 
fraud, ongoing efforts are needed to ensure that information furnished to consumer 
reporting agencies is accurate, timely, and complete. Concerns about the accuracy 
of consumer reports can be alleviated to some extent through consumer education, 
such as efforts to encourage consumers to check their consumer reports periodically. 

Adverse Action Notices and Risk-Based Credit Pricing 

Under the FCRA, if a creditor denies credit or takes other “adverse action” based 
on information in a consumer report, the creditor generally must give the consumer 
a notice of that fact. Among other things, the notice must also tell consumers of 
their right to obtain a free copy of their credit report and to dispute inaccurate in- 
formation. The FCRA incorporates the definition of “adverse action” contained in the 
Equal Credit Opportunity Act and its implementing regulation, the Federal Reserve 
Board’s Regulation B. Under the ECOA and Regulation B, consumers are entitled 
to a notice containing the specific reasons for a credit denial or other adverse action. 
The FCRA and ECOA notices, which are typically combined, provide an important 
tool in educating consumers about the impact on credit availability of negative infor- 
mation in their consumer reports. Receiving notice of the specific reasons for ad- 
verse action coupled with notice that the adverse action was based, in whole or in 
part, on information in a consumer report: (1) Alerts consumers to specific problems 
or possible inaccuracies in their credit reports, and (2) informs consumers of their 
right to obtain a free copy of the report and to dispute inaccurate information. 

With the increase in risk-based pricing, consumers who previously would have 
been denied credit (and would have received adverse action notices) now are offered 
credit at rates that reflect their risk as borrowers, thus expanding access to credit. 
When a consumer accepts a creditor’s offer of credit, even on different terms from 
those that were requested, an adverse action notice is not required under Regulation 
B, and hence is not required under the ECRA. Therefore, when consumers apply for 
credit, adverse action notices are given to them less frequently than in the past. 

Concern has heen raised that because of risk-based pricing, adverse action notices 
may no longer be meeting at least part of the intended purpose under the ECRA — 
helping to ensure the accuracy of consumer reports. Inaccurate information in a 
consumer report may negatively impact access to credit at rates that reflect the con- 
sumer’s creditworthiness, but there is no adverse action notice directing the con- 
sumer’s attention to potential errors may stand in the way of more favorable terms. 

One suggested approach for addressing this concern is to revise the FCRA defini- 
tion of adverse action to require that creditors provide an adverse action notice 
whenever credit is granted on material terms less favorable than those otherwise 
available. For example, a creditor using a risk-based pricing system may offer a 
credit card based on an assessment of the consumer’s creditworthiness with rates 
ranging from 7.99 to 14.99 percent. A consumer would receive an adverse action no- 
tice if the consumer was offered and accepted a rate of 8.99, rather than the lowest 
rate of 7.99 percent, based on that risk assessment. Providing adverse action notices 
to consumers that receive credit might provide some benefit to consumers, but at 
a cost to industry that likely would outweigh the potential benefit. 

Other tools could be made available to consumers to mitigate these concerns. For 
example, the Congress is now considering legislation to give consumers the right an- 
nually to obtain a free copy of their consumer reports upon request. If enacted, such 
legislation could encourage consumers to check their consumer reports periodically, 
particularly if coupled with appropriate consumer education about the importance 
of consumer reports and how to check for accuracy. 


’’Id. at 70-73. 
»Id. at 71-72. 
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Consumer Education and Financial Literacy 

Consumer education and financial literacy play an important role in helping con- 
sumers to understand the credit system and their own credit standing.® Financial 
education can equip consumers with the knowledge required to make better choices 
among the financial products and services, thus enabling consumers to obtain those 
products and services at the lowest cost available to them. Financial education is 
particularly valuable for populations that have traditionally been underserved by 
the financial system and may help protect vulnerable consumers from abusive credit 
arrangements that can be financially devastating. 

Markets operate more efficiently when consumers are well informed. Making in- 
formed decisions about what to do with their money will help build a more stable 
financial future for individuals and their families. The Federal Reserve System re- 
cently launched a national financial education initiative to encourage consumers to 
learn more about personal financial management, complete with a public service an- 
nouncement that featured Chairman Greenspan. The objective of this initiative is 
to highlight the benefits of financial education and to provide information on the 
resources available to consumers for assistance in managing their finances. The 
Federal Reserve’s financial education website (www.FederalReserveEducation.org) 
makes available a variety of materials that may be useful to consumers, including 
a brochure entitled, “There is a Lot to Learn about Money” that contains tips for 
managing credit wisely and protecting personal credit ratings. 

In addition, the Federal Reserve Bank of Boston has published an excellent edu- 
cational video and booklet on identity theft that explains what identity theft is, how 
consumers can protect themselves from becoming victims, and what they should do 
if they do become victims. These materials also explain the importance of checking 
consumer reports regularly, provide tips for how to read a consumer report, and list 
appropriate contact information for the three major consumer reporting agencies 
and certain Federal Government agencies. A copy of the Boston Reserve Bank’s 
identity theft booklet can be viewed online at the Federal Reserve Bank of Boston’s 
public website (www.bos.frb.org I consumer I identity I index.htm). 

Conclusion 

The Committee is to be commended for undertaking an examination of the FCRA 
and related issues at this important juncture. In conducting this examination, it is 
important to maintain a viable, national credit reporting system that preserves and 
expands reasonable access to credit, and to promote consumer understanding and 
awareness of the credit reporting system and how it relates to the credit granting 
process. 


PREPARED STATEMENT OF DONNA GAMBRELL 

Deputy Director for Compliance and Consumer Protection 
Division of Supervision and Consumer Protection 
Federal Deposit Insurance Corporation 

July 29, 2003 

Chairman Shelby and Senator Sarbanes, thank you for inviting me to testify on 
behalf of the Federal Deposit Insurance Corporation (FDIC). The FDIC has been 
closely following the hearings on the Fair Credit Reporting Act (FCRA) and related 
issues. At stake are matters that affect both individual consumers and the manner 
in which the Nation’s economy operates. FDIC Chairman Don Powell has stated his 
support for making the expiring FCRA preemption provisions permanent. Doing so 
will ensure the continuity of the credit reporting system of our Nation — a system 
that provides consumers with unparalleled access to credit that generally costs less 
than the credit available in other parts of the world. We thank you for your careful 
consideration of these important issues. 

We also commend the Committee’s attention to the difficult problems associated 
with combating identity theft. For its part, the FDIC is coordinating an effort among 
the Federal financial institution regulators to publish guidance on measures that 
should be taken when security breaches occur that may lead to identity theft. We 
believe that institutions should take active steps to minimize potential harm to con- 


®The Federal Reserve, however, does not have data that measure consumers’ level of knowl- 
edge or awareness of credit reporting, credit scoring, or how the credit system operates. We do 
conduct consumer research but the focus generally targets consumer knowledge of specific prac- 
tices or products. 
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sumers whose information has been breached, and urge a proactive approach when 
an institution becomes aware of a breach. 

The Nation’s credit system and its regulatory framework have played a vital role 
in increasing the availability of credit to a broader cross section of American con- 
sumers, particularly in historically underserved market segments. The Federal Re- 
serve Board’s 2001 Survey of Consumer Finances indicates that between 1970 and 
2001, the share of households with credit cards increased from 16 to 73 percent. 
More dramatically, during the same period, access to credit cards for the lowest in- 
come quintile increased from 2 percent to 28 percent. Greater access to credit also 
has meant greater access to mortgage financing. Between 1983 and 2001, overall 
homeownership increased from 60 percent to 68 percent of U.S. households. The 
largest increases in homeownership were observed among minorities and lower- 
income households. During the same period, homeownership among families with 
incomes of less than $10,000 increased from 29 percent to 34 percent, and home- 
ownership among families with incomes between $10,000 and $25,000 increased 
from 49 percent to 54 percent. 

Policymakers and financial institutions alike have made commendable efforts to 
broaden the scope of banking products for low- and moderate-income people. How- 
ever, many families still fall outside of the financial mainstream and do not main- 
tain traditional bank credit, savings, or investment accounts. Nearly 10 percent of 
U.S. families do not have transaction accounts. “Unbanked” individuals tend to: 
Have low incomes, not own homes, be under 35 years of age, be nonwhite or His- 
panic, be unemployed, and be educated at the high school level or below. 

Some low- and moderate-income households have been able to take advantage of 
access to banking services, but are finding themselves very unprepared to deal with 
the complexities that characterize today’s financial environment. Unfortunately, one 
of the undesirable consequences of the expansion of credit markets has been the 
rise of predatory lending and other abusive practices. New customers who are less 
familiar with traditional banking products and practices are certainly more suscep- 
tible to accepting disadvantageous or even illegal terms. These consumers also may 
be able to access more credit than they can reasonably repay. 

Clearly, increased knowledge on the part of consumers is a significant way to com- 
bat these problems. The FDIC Consumer News (circulation: 75,000) routinely dis- 
cusses issues such as personal financial management and consumer protection as 
a way to raise awareness among bankers and consumers. Consumer protection 
issues discussed in detail include identity theft, predatory lending, and financial 
fraud. The FDIC also recognizes the need for a more comprehensive approach to fi- 
nancial education that will better equip consumers to enter the financial main- 
stream. Consumers need to understand the existing protections that guard against 
discrimination or unfair treatment in the lending process and the recourse available 
to them under the law. They also need to understand the wide variety of financial 
services that are available to them. 

Money Smart 

Three years ago, the FDIC was grappling with the problem of misleading and 
abusive marketplace practices brought to our attention by consumers, the banking 
industry, and Government agencies. As part of our effort to explore solutions to this 
problem, the FDIC held forums on predatory lending in seven locations nationwide. 
Those attending the meetings included bankers, community leaders, city and State 
officials, and local residents. Participants identified problems in their particular geo- 
graphic area and recommended solutions, which ranged from more legislation to bet- 
ter enforcement of existing regulations. But there was one recommended solution 
that remained constant across all participants: Enhanced consumer education. 

This recommendation provided the impetus for the FDIC to develop “Money 
Smart” as a way to address a number of problems affecting consumers such as: The 
lack of traditional banking relationships for millions of Americans; consumer reli- 
ance on so-called “fringe providers” at costs they can ill afford; abusive lenders tar- 
geting vulnerable segments of our population; identity theft; inaccurate credit 
reports; and unwise use of credit. Numerous studies have shown that financial edu- 
cation efforts can foster positive changes in behaviors and better equip consumers 
to operate within the financial arena. We share that point of view. 

We introduced Money Smart in the summer of 2001 as a program uniquely de- 
signed to address the needs of low- and moderate-income adults new to the banking 
system or lacking the knowledge to reap potential rewards or avoid pitfalls. We de- 
signed Money Smart to be easy to teach and easy to learn. It can be taught in its 
entirety, or specific modules can be used to fill in the gaps in other financial edu- 
cation programs. We make Money Smart available free of cost and without copy- 
right so that organizations desiring to use the program can reproduce and use the 
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program materials as needed. Also, we have made clear that banks can receive 
Community Reinvestment Act credit for their involvement in offering Money Smart 
classes in their communities. 

We have made a number of improvements to the program since introduction. Be- 
cause immigrant populations represent a significantly underserved market, we have 
translated Money Smart into Spanish, Chinese, and Korean, and we will have a Vi- 
etnamese translation by the end of this year. Also, we have added a CD-ROM 
version of the program. This has improved accessibility to the program and has 
helped to keep our costs low during a period where we have dramatically increased 
distribution to meet increasing demand. We also plan to release a web-based inter- 
active version of the curriculum in early 2004 so that individuals without access to 
an instructor can learn on their own online. 

Money Smart has generated a great deal of interest since it began in July 2001. 
It has been widely cited in over a hundred national and local publications. We have 
also received requests for the Money Smart curriculum from Mexico, Thailand, and 
Canada. To date, we have provided more than 22,000 institutions and organizations 
across the country with over 75,000 copies of Money Smart. About a quarter of the 
copies were requested by FDiC-insured financial institutions and credit unions, 
while we are pleased with these numbers, FDIC Chairman Donald Powell has set 
an even more aggressive goal for the next 4 years: To establish partnerships with 
1,000 organizations and institutions, in all 50 States; to distribute 100,000 copies 
of Money Smart; and to expose one million consumers to our financial education pro- 
gram. We are committed to meeting this goal. 

Money Smart consists of 10 instructor-led training modules covering the following 
topics: Bank On It — an introduction to bank services; Borrowing Basics — an intro- 
duction to understanding credit; Check It Out — how to open and maintain a check- 
ing account; Pay Yourself First — the importance and benefits of, and methods for, 
saving money; Money Matters — preparing a personal budget; Keep It Safe — con- 
sumer rights and responsibilities; To Your Credit — the importance of credit history; 
Charge it Right — the costs and benefits of using a credit card; Loan To Own — the 
costs and benefits of consumer loans; and Your Own Home — an introduction to home 
loans. Four of these modules — Borrowing Basics, Keep It Safe, To Your Credit, and 
Charge It Right — address credit-related issues discussed in the recent hearings be- 
fore this Committee, including recognizing the value of credit, understanding credit 
reports, repairing credit, identifying potential problems with credit card use, becom- 
ing familiar with consumer protection laws, avoiding identity theft, and steering 
clear of scams. 

We believe that a critical factor in the success of Money Smart has been our em- 
phasis on working through our regional community affairs staff to establish rela- 
tionships with local organizations that are best situated to bring Money Smart to 
those who could benefit from it. In announcing the Money Smart Alliance Program 
last year, Chairman Powell stated its purpose would be to increase financial literacy 
in communities where it is most needed. To date, over 340 organizations throughout 
the country — in both urban and rural communities — have joined our Money Smart 
Alliance. These organizations represent a wide spectrum of delivery systems for our 
financial education program — social services, financial institutions, housing services, 
educational services, community organizations, as well as Government, faith-based, 
and employment services. Money Smart Alliance members facilitate implementation 
of our financial education program by making contributions in a variety of ways, 
including promotion, delivery, translation, funding, and evaluation. 

We also have entered into formal partnerships with 20 major public and private 
sector organizations that have a nationwide capability to deliver Money Smart. 
These partnerships are a critical component in our strategy to broaden our ability 
to deliver financial education to more consumers. 

For example, under a partnership agreement with the Neighborhood Reinvest- 
ment Corporation, Money Smart has been used to train 315 adult educators in 39 
major cities, who, in turn, taught money management skills to a total of over 5,500 
students. These students primarily consist of low-income consumers, minorities or 
women who are potential homebuyers or existing homeowners having problems 
making ends meet. In our partnership with the Department of Defense (DoD), we 
plan to reach thousands of military personnel by using Money Smart curriculum in 
conjunction with financial counseling. DoD also will offer seminars on an ongoing 
basis to service members and their families. In the private sector, we have corporate 
partners, such as Wachovia Corporation, that have agreed to reach 5,000 low- and 
moderate-income individuals this year in 11 States and the District of Columbia 
through employee volunteerism in their communities. 

Other national partners include the: Association of Military Banks, American 
Bankers Association Education Foundation, Conference of State Bank Supervisors, 
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National Bankers Association, Independent Community Bankers Association, Amer- 
ica’s Community Bankers, Department of Housing and Urban Development, USDA 
Rural Development, Operation Hope, Office of the White House Initiative on Asian 
Americans and Pacific Islanders, Internal Revenue Service, Department of Labor, 
National Coalition of Asian Pacific American Community Development, Goodwill In- 
dustries, Opportunities Industrialization Centers of America, Inc., Women in Hous- 
ing and Finance, Inc., and National Image, Inc. 

Based on our experience and suggestions from our many partners, we determined 
that building additional program delivery capacity was essential. Specifically, the 
FDIC concluded that train-the-trainer workshops for banks and community organi- 
zations would boost the program and should be a major focus in 2003, and beyond. 
Early this year, we launched a major train-the-trainer campaign. The train-the- 
trainer initiative not only increases capacity, but has the added bonus of further 
standardizing instruction. As of June, we have held over 50 train-the-trainer work- 
shops attended by more than 1,700 people. The workshops are free and the FDIC 
projects each trainer will go on to teach approximately 40 persons annually. Because 
we need to be focused on not only quantity, but also quality, we have developed 
model programs that blend a strong financial curriculum with service programs and 
proven asset building strategies. The FDIC has taken the lead in establishing part- 
nerships with community and banker coalitions to link financial education with 
low-cost bank accounts and services, free tax preparation services through the IRS 
Volunteer Income Tax Assistance (VITA), Earned Income Tax Credit (EITC) funds. 
Individual Development Accounts (IDA’s), homeownership counseling, job coun- 
seling, and other programs. To demonstrate the flexibility of our financial education 
program and its ability to reach diverse groups of consumers, each of the FDIC’s 
eight regional and area offices, as well as our headquarters in Washington, have es- 
tablished Money Smart Model Site Projects. A model site is a sustainable initiative 
in which Money Smart classes are taught on a regular basis, there is active partici- 
pation by one or more financial institution(s) and links are established with other 
asset-building or service programs. To date, we have established 17 model sites 
throughout the country. The following are a few highlights from these efforts. 

• The DeKalb Workforce Center in Georgia serves as the FDIC Atlanta Region’s 
model site. The 2-year target is to move a minimum of 500 previously unbanked 
consumers into the financial mainstream. Partners include: Decatur First Bank, 
Wachovia Bank, Bond Community Credit Union, Washington Mutual, SouthTrust 
Mortgage, SunTrust, United Way, Federal Reserve Bank of Atlanta, Lutheran 
Services Department of Labor (Employment and Training and the Women’s Bu- 
reau), Decatur/DeKalb Housing Authority, Internal Revenue Service, Decatur 
High School, New Leaf, Columbia Residential Properties, and Network IDA of the 
Southeast. Consumer education workshops, with Money Smart as the core cur- 
riculum, are taught by DeKalb Cooperative Extension personnel and volunteers 
from financial institutions. Class participants have the opportunity to access low- 
cost electronic/checking products and services. In addition, the model site offers 
IRS Volunteer Income Tax Assistance, providing free tax preparations in an effort 
to help low-income families claim teix credits and receive refunds that can be used 
to establish new bank accounts or reach other long- or short-term financial goals. 
In May 2002, the DeKalb Workforce Center received a First Accounts Award of 
$271,000 from the U.S. Department of the Treasury to further its financial edu- 
cation efforts. To date, over 1,400 persons have taken Money Smart classes in 
English and Spanish. In addition to the adult education component in this model 
site, Decatur High School offers Money Smart as part of its job readiness program 
for seniors who will enter the workforce after graduation rather than go to college. 

• Our Kansas City Regional Office has taken the unique approach of establishing 
a three-pronged model site project to reach consumers in rural, urban, and Native 
American communities located in Iowa, Kansas, Minnesota, Missouri, Nebraska, 
North Dakota, and South Dakota. As a result of the 17 coalitions formed from the 
204 Money Smart Model Site partners in these States, over 8,600 individuals have 
been able to participate in Money Smart classes and 1,100 of them have opened 
bank accounts. 

• Several of our Model Sites across the county have teamed up with organizations 
administering programs for Temporary Assistance for Needy Families (TANF) cli- 
ents. As you know, TANF is a tJ.S. Department of Health and Human Services 
program that awards block grants to States to provide assistance and work oppor- 
tunities to needy families. The model site, formed by our Boston Regional Office 
with the Williamanic-Danielson Partnership and Department of Labor Employ- 
ment One-Stop Centers in Connecticut, is an excellent example of our effort to 
reach these consumers. It combines both mandatory and voluntary financial edu- 
cation classes to reach over 1,500 low- and moderate-income adults, including both 
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TANF clients and IDA program participants. The IRS VITA and Earned Income 
Tax Credit (EITC) programs also are available to class participants. One client 
named Maria shared with us her dream of owning her own home. Maria has three 
children and is participating in the IDA program offered in conjunction with 
model site partner ACCESS Agency, a nonprofit community-based organization. 
After attending 6 weeks of Money Smart classes, Maria learned how to budget 
her money and is taking steps to repair her credit history. She is saving with the 
help of another model site partner, the Savings Institute of Williamanic, which 
administers the IDA savings account. With the help of the dollar-for-dollar match- 
ing funds Maria receives through her IDA savings account, she is on her way to 
realizing her dream of homeownership. 

We recognize that the long-term success of Money Smart is largely dependent on 
our ability to set measurable goals for the program and monitor our results on an 
ongoing basis. Two critical metrics for measuring the program’s success are: (1) The 
number of people who complete the program; and (2) the number of people who en- 
tered into a banking relationship (that is, opened up a checking or savings account) 
after attending at least one Money Smart financial education class. To measure 
these statistics, we recently completed a large-scale effort to survey over 9,000 orga- 
nizations that ordered Money Smart from the FDIC between July 2001 and October 
2002. Data from 2,641 respondents to the survey indicated that over 85,000 partici- 
pants attended at least one Money Smart class during the survey period. Accounting 
for the organizations that did not participate in the survey, and the additional 
Money Smart financial education that has taken place since the end of 2002, we ex- 
pect that the number of participants that have attended at least one Money Smart 
class to date exceeds 100,000. The survey also indicates over 13,000 Money Smart 
participants went on to initiate a banking relationship as a result of the program. 

To plan for the future of Money Smart, Chairman Powell is seeking advice from 
people involved in consumer finance. In June, we assembled a forum in Chicago to 
explore issues related to financial literacy. We also are in the preliminary stages 
of planning a financial literacy symposium here in Washington. Our goal is to as- 
semble a broad spectrum of those with experience to identify innovative solutions 
for banks to become more progressive in meeting their community lending respon- 
sibilities and better meet the needs of the unbanked. Last week, we sent out our 
first Money Smart electronic newsletter to each of the institutions or organizations 
that have ordered the curriculum thus far. Our hope is that the newsletter will be 
an effective way for us to keep abreast of and share information on how Money 
Smart is being implemented by banks, community organizations. Government agen- 
cies, colleges and universities, and others. A link to the newsletter and other infor- 
mation about Money Smart can be found at the FDIC website at www.fdic.gov. 

We have a great banking system in this country. We have a credit market that 
is the envy of the world, and we believe everyone should have an opportunity to 
participate. With Money Smart and the additional dialogue we are proposing, we 
will have the means to offer better access and financial alternatives to the most 
needy in our society. Our plans for the future include additional program surveys 
and assessments, continued expansion of collaborative efforts to deliver Money 
Smart to consumers, and exploration of additional steps to bring the unbanked and 
underserved into the financial mainstream. 

Again, thank you for giving me the opportunity to testify before you this morning 
on this critically important topic. I look forward to answering any questions you 
might have. I also make the offer on behalf of Chairman Powell to assist any Sen- 
ator interested in looking into establishing Money Smart programs for their con- 
stituents. Please contact us so that we might have our regional staff meet with your 
staff to help bring Money Smart to your communities. 


PREPARED STATEMENT OF JOEL WINSTON 

Associate Director, Financial Practices Division 
Bureau of Consumer Protection, U.S. Federal Trade Commission 

July 29, 2003 

Mr. Chairman and Members of the Committee, my name is Joel Winston. I am 
Associate Director for Financial Practices at the Federal Trade Commission (Com- 
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mission or FTC). The Division I head is responsible for enforcing the various con- 
sumer credit laws subject to the Commission’s jurisdiction.^ 

I am pleased to appear today to discuss “financial literacy,” both generally and 
as it relates to the Fair Credit Reporting Act (FCRA). This is a topic of critical 
importance, especially because the FCRA relies on the vigilance of consumers in pro- 
tecting their own rights. Our economy operates most efficiently when consumers un- 
derstand the credit system so they can make the best decisions about their finances. 

The FTC’s Consumer Education Program 

The Commission has undertaken significant efforts to educate consumers about 
financial matters generally and credit issues specifically. Consumer education is 
among our most important tools in the fight against fraud and deception, because 
consumers are their own first line of defense. Through our Division of Consumer 
and Business Education, we continue to develop creative and effective ways of 
reaching consumers to arm them with the information they need. We have over 30 
publications related to consumer credit topics, ranging from advance-fee loans ^ to 
vehicle financing.^ These publications are available directly from the FTC and 
through a variety of partner organizations and the Federal Citizen Information Cen- 
ter in Pueblo, Colorado. All these materials are on the Commission’s website at 
www.ftc.gov. Credit publications have consistently been among the Commission’s 
most popular items. Last year, we distributed about 2 million credit-related bro- 
chures in print, and consumers accessed these publications on the Commission’s 
website another 1.5 million times. Twelve of our credit publications are available in 
Spanish, and more are in the translation pipeline. 

Both at our headquarters here in Washington and in our regional offices, we have 
partnered with many outside organizations to improve financial literacy. For exam- 
ple, our Northeast Region works with colleges and universities in an effort called 
“Project Credit Smarts,” in which we make presentations and distribute credit-re- 
lated publications during student orientation sessions. We have similar working re- 
lationships with organizations such as the Jump$tart Clearinghouse, the American 
Savings Education Council, AARP, the Consumer Federation of America’s Consumer 
Literacy Consortium, the National Consumers League, and the Department of De- 
fense. We also distribute financial education materials at national meetings of the 
NAACP, National Urban League, National Council of La Raza, and the League of 
United Latin American Citizens, among others. 

When the Commission takes law enforcement action, it strives to combine it with 
an educational effort. Each action comes with a press release and outreach efforts 
to consumers. Many cases are accompanied by a consumer education publication 
that re-emphasizes the messages consumers should take away from the case.'' 

Our identity theft program is another important way in which we educate con- 
sumers about credit matters. One of the most devastating consequences of identity 
theft is the damage that it causes to the victim’s credit record. As you know. Con- 
gress designated the Commission to operate the national clearinghouse for identity 
theft complaints. We offer publications with tips on how to avoid identity theft and 
what to do if it happens. Last year, the Commission distributed about 1 million 
identity theft publications and registered an estimated 2 million hits to our identity 
theft website. 

There are many sources of financial education materials throughout Government 
and the private sector. For example, the National Endowment for Financial Edu- 
cation, a nonprofit foundation, provides funding, support, and expertise to develop 
financial literacy programs for the public. The three major credit bureaus and Fair 
Isaac Corporation, a major developer of credit scores, all operate websites with use- 
ful information about credit reports and scores. 

Consumer Education and the FCRA 

Unfortunately, many consumers have limited knowledge of our credit reporting 
system. They may not realize information about their financial history is compiled 
and sold, not only just to creditors, but also to employers, insurers, landlords, utili- 


' The views expressed in this statement represent the views of the Commission. My oral pres- 
entation and responses to questions are my own and do not necessarily represent the views of 
the Commission or any Commissioner. 

2 “Easy Credit? Not So Fast. The Truth About Advance-Fee Loan Scams” {http:! j www.ftc.gov ! 
bcp i coniine I pubs / tmarkg I loans.pdf). 

3 “Understanding Vehicle Financing” {http: !! www.ftc.gov ! bcp Iconline ! pubs! autos! 

vehfine.pdf). 

''For example, the Commission’s announcement of its settlement with Mercantile Mortgage 
Co. included consumer education regarding home equity loans. See http: ! Iwww.ftc.gov ! opa! 
2002 !07 ! mercantilediamond.htm. 
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ties, and others who use it to make decisions. Consumers may not know what infor- 
mation is reported about them, who uses it, and for what purposes. They may not 
understand how that information affects their ability to get a loan, insurance, or a 
job, and what rights they have to ensure the information is accurate. Uninformed 
consumers may not take the steps they should to improve their credit ratings or cor- 
rect errors. Improving financial literacy may not by itself ensure that consumers are 
successful in using our credit system, but it is certainly a key component. 

It also is important to remember that the FCRA itself serves an important edu- 
cational function. The FCRA mandates that information be made available to con- 
sumers in many different contexts. Perhaps most important, the law requires that 
lenders and other users of credit reports notify consumers when they take “adverse 
action” based on information from a credit report. The notice must tell consumers 
that the action was based, in whole or in part, on information in a credit report. 
The notice also must disclose which credit bureau supplied the report, and advise 
consumers of their rights to a free copy of the report and to dispute the accuracy 
of the information in it. This notice puts credit reports in consumers’ hands when 
they are the most motivated to act on it — that is, after they have been denied credit, 
insurance, employment, or benefits based on the report. 

Consumers receive additional information when they obtain credit reports from 
the bureaus, whether in response to an adverse action notice or otherwise. In 1996, 
Congress mandated that the bureaus send with the report a copy of a document 
called a “Summary of Consumer Rights.” This summary briefly describes the FCRA 
and explains the consumer’s rights under the statute, and directs consumers to the 
FTC’s website, which has extensive information about the FCRA and other credit 
laws, and to the Commission’s toll-free telephone helpline. 

The Commission’s legislative recommendations, about which Chairman Muris tes- 
tified before this Committee on July 10, would result in better-educated consumers.® 
Our proposals would put more information in consumers’ hands by: (1) Expanding 
consumers’ right to adverse action notices when they are offered less favorable cred- 
it terms; (2) making annual credit reports available at no charge, and (3) giving con- 
sumers more information about their credit scores along with explanatory materials. 

The Commission’s proposals also would empower consumers to act on this im- 
proved information by streamlining the dispute process. For example, the Commis- 
sion supports an amendment that would require resellers of consumer reports to 
submit disputes to the originating repository to investigate these disputes.® In addi- 
tion, the Commission believes that the law should be amended to require furnishers 
of information to investigate consumer disputes when the consumers contact them 
directly.'^ 

Thank you for the opportunity to discuss the Commission’s efforts in the area of 
financial literacy. I will be happy to answer any questions you may have. 


PREPARED STATEMENT OF TRAVIS B. PLUNKETT 

Legislative Director, Consumer Federation of America 

July 29, 2003 

Good morning Chairman Shelby, Ranking Member Sarbanes, and the Members of 
this Committee. My name is Travis B. Plunkett and I am Legislative Director of 
the Consumer Federation of America. Thank you for this opportunity to offer our 
comments on consumer awareness and understanding of the credit granting and re- 
porting process. We have been involved for many years in efforts to increase the 
transparency and effectiveness of the credit reporting system for consumers. 

I applaud the Committee for conducting a hearing on such an important — and lit- 
tle understood — subject. The hearing is very timely for several reasons. First, unless 
consumers understand the credit reporting system and have access to clear, timely 
information, they won’t be able to use the rights granted to them under the Fair 
Credit Reporting Act. The Act expects a great deal from consumers because signifi- 
cant protections are only triggered if consumers take narrowly defined actions. For 
example, if a consumer doesn’t know to contact a credit bureau to trigger a reinves- 
tigation of a credit reporting problem, he or she might waste valuable time con- 


® See Testimony of Timothy J. Muris before the Senate Committee on Banking, Housing, and 
Urban Affairs, July 10, 2003 {httpil / ivww.ftc.gov I os 1 2003 / 07 / fcrasenatetest.htm). 
id. at 10. 

See id. at 15. 

^CFA is a nonprofit association of 300 pro-consumer organizations that, since 1968, has 
sought to advance the consumer interest through education and advocacy. 
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tacting his or her lender and never get the problem resolved. This is because, as 
you know, the lender is currently under no legal obligation to begin a reinvestiga- 
tion unless contacted by a credit bureau. 

Second, with the advent of “risk-based pricing” in the last decade, the way that 
credit is granted in this country has changed dramatically, but information provided 
to consumers under the FCRA about the nature of these loans has not kept up with 
this change. These days, a consumer with some credit blemishes is much more likely 
to be offered a higher-cost loan with less favorable terms than to be denied a loan. 
Misclassification as a high-risk, subprime borrower because of a credit report error 
or incomplete reporting by a furnisher (creditor) can cause consumers to pay tens 
or hundreds of thousands of dollars in higher interest rates. CFA’s report on credit 
score accuracy issued last December found that eight million Americans are likely 
to be misclassified as subprime upon applying for a mortgage, based on the study’s 
review of credit files for errors and inconsistencies.^ Yet, millions of consumers have 
no way of knowing that this has occurred, because under the “counteroffer” loophole 
in the FCRA, they do not receive an adverse action notice and are not granted the 
right to look at their credit report at no charge and check for inaccuracies. 

And finally, there has never been greater need for Congress to discuss how it can 
help boost overall financial awareness and improve financial decisionmaking by 
Americans, especially in regards to the credit reporting and credit granting process. 
For three decades, our organization has sought to improve financial “literacy” 
among the public and to promote effective financial education. 

In response to the invitation to testify at this hearing, the Consumer Federation 
of America commissioned a study about consumer knowledge of credit reports and 
scores and the level of public support for a variety of protections that this Com- 
mittee may consider. More than 1,000 adults were interviewed.^ We found that a 
strikingly high percentage of Americans not only do not understand basic facts 
about credit reports and scores, but also acknowledge their own lack of under- 
standing about the subject. This recognition and awareness of the growing impor- 
tance of credit scores, may explain why the survey found overwhelming support for 
new consumer protections. An important finding of the survey is also that low- and 
moderate-income Americans — those who tend to pay the highest price for credit and 
are most vulnerable to inaccurate credit scores — are the least knowledgeable about 
credit reports and scores. 

Most Americans Say They Don’t Understand Credit Reports 
and Scores Well 

When asked to assess their knowledge of credit reports and credit scores, most 
Americans say their knowledge is fair or poor. Fifty percent said their knowledge 
of credit reports was fair or poor, while 61 percent said their knowledge of credit 
scores was fair or poor. 

Lower-income Americans are most likely to believe their knowledge isn’t good. 
More than 60 percent of those in households with incomes under $35,000 said their 
knowledge of credit reports was fair or poor. Nearly 70 percent of these low- and 
moderate-income Americans said their knowledge of credit scores was fair or poor. 

Young adults between the ages of 18 and 24 were also likely to say their knowl- 
edge was not good. Sixty-two percent said their knowledge of credit reports was fair 
or poor, while 78 percent said their knowledge of credit scores was fair or poor. 

Many Americans Lack Essential Knowledge About Credit Reports 
and Scores 

The survey also tested actual consumer knowledge about credit reports and 
scores. Only 25 percent of Americans — and less than 20 percent of those with in- 
comes below $35,000 — said they knew what their credit score was. And only 3 per- 
cent of Americans could, unprompted, name the three main credit bureaus — 
Experian, Equifax, and TransUnion — that provide both lenders and consumers in- 
formation from credit reports. Forty-three percent of Americans — only 35 percent of 
those with incomes below $35,000 — said they had obtained a copy of their credit re- 
port from the three credit bureaus in the past 2 years. 

The survey also tested consumer knowledge using a series of true-false questions. 
The good news from this test is that large majorities understand that consumers 
have the right to see their credit report (97 percent) and that consumers who fail 


2 Consumer Federation of America and National Credit Reporting Association. Credit Score 
Accuracy and Implications for Consumers. December 2002. Available at: http: 1 1 www. consumer 
fed.org f 12 1702CFA_NCRA Credit Score Report Final.pdf. 

^ The survey was conducted by Opinion Research Corporation International. ORCI interviewed 
a representative sample of more than 1,000 adult Americans from July 18 to 21, 2003. The sur- 
vey’s margin of error is plus or minus 3 percentage points. 
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to qualify for a loan have the right to a free credit report (81 percent). The bad news 
is that many consumers do not understand that in most States they must pay a fee 
to obtain their credit report (54 percent), that their credit score may be lowered if 
they use all of the credit available on their credit card (55 percent), that their credit 
score may be lowered if they apply for a credit card (62 percent), and that they are 
not required to contact their lenders if they believe that their credit report or score 
is inaccurate (64 percent). Also, 27 percent incorrectly believe that their credit score 
mainly measures their knowledge of consumer credit, not their creditworthiness. 

Finally, the survey tested the knowledge about which service providers often use 
credit scores to decide whether consumers can purchase a service or at what price. 
Many Americans are not aware that certain service providers frequently use these 
scores — 60 percent were not aware that electric utilities do so, 41 percent for home 
insurers, 41 percent for landlords, and 38 percent for cell phone companies. By com- 
parison, only 13 percent did not know that credit card companies use credit scores. 

Large Majorities Support Stronger Consumer Protections 

The survey also questioned Americans about their opinions on new consumer pro- 
tections currently being considered by Congress. The protections would give con- 
sumers greater access to their credit reports and scores, and strengthen individual 
remedies that they could pursue. The protections would also require credit bureaus 
to do a better job of verifying consumer identities and would proscribe certain lender 
practices. 

Large majorities indicated their support for these protections. 

Credit bureaus should do a better job of verifying identities on credit applications 
to reduce identity theft — 96 percent support, 83 percent strongly. 

Consumers who are denied a loan or charged a high price should be able to get 
from the lender a free copy of the credit report and score used as the basis for the 
lender’s decision — 94 percent support, 78 percent strongly. 

A bank should not be allowed to use your medical information to make credit deci- 
sions without your consent — 87 percent support, 77 percent strongly. 

A bank should be required to obtain your permission before it can share your fi- 
nancial information with other companies it owns — 91 percent support, 76 per- 
cent strongly. 

Consumers should be able to obtain a free credit report and score once a year 
from the three main credit bureaus — 91 percent support, 71 percent strongly. 

Consumers should be able to sue lenders who knowingly provide credit bureaus 
with incorrect, damaging information — 84 percent support, 62 percent strongly. 

A credit card lender should not be allowed to raise the interest rate because of 
a credit problem that involves another lender — 75 percent support, 52 percent 
strongly. 

The cumulative effect of the extremely broad support for these proposed reforms 
is nothing less than a mandate for a comprehensive overhaul of the Fair Credit Re- 
porting Act. Consumers want easier access to their credit reports and scores, greater 
protections against privacy and credit reporting abuses, and the right to go after 
lenders in court who repeatedly make grievous errors. 

Empowering Consumers through Reforms to the Fair Credit Reporting Act 

Given the relatively low levels of knowledge about credit reporting and scoring re- 
ported by the survey, it is especially important that Congress improve the trans- 
parency of the credit reporting system. We also strongly recommend that Congress 
overhaul the cumbersome and out-of-date procedures under the FCRA for resolving 
disputes between consumers and credit bureaus, and between consumers and data 
furnishers, such as credit card companies. 

First, give consumers more information. Information, provided in a clear 
manner and on a timely basis, is the key to improving consumer knowledge of the 
credit reporting process. Our recommendations will provide consumers with more in- 
formation about their credit reports and scores in two ways: (1) On an ongoing 
basis — so that consumers can eliminate inaccuracies and prevent problems before 
they occur — and, (2) when credit troubles arise because of a credit report, such as 
the denial of a loan or an offer to extend credit on less than favorable terms. 

• Credit bureaus should be required to provide consumers with their cred- 
it reports and their credit scores once a year upon request at no charge. 
They should be given a description of the major factors that are used to calculate 
the score, the weight of each factor in calculating the score, and how the consumer 
rated on each major factor. Free credit reports, once a year upon request, are cur- 
rently required in legislation that has just moved to the House floor (H.R. 2622) 
but the bill does not require free access to the score. Charging a fee for credit 
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scores will not only mean that fewer consumers will learn their score, but it un- 
dercuts the goal of offering the report at no charge, since reports and scores are 
often marketed to consumers as a package product. Also, disappointingly, the full 
Committee accepted an amendment to limit provision of the free credit report an- 
nually on request to the national repositories. The original version of the bill 
would have required all credit bureaus to provide a free credit report on request. 

• Congress should mandate that these reports be easy to get, perhaps 
through the establishment of a registry at the Federal Trade Commission that 
will allow consumers to call or e-mail one location and get a copy of their reports 
from all three major credit bureaus. Consumers should not be limited to making 
requests only by mail, or have to deal with a complicated and time-consuming 
voice mail system, or have to click through page after page of information online 
simply to get access to a free report. Credit bureaus could easily undermine the 
goal of improving consumer access to their reports and scores if they make it cum- 
bersome for people to request this information. To deal with privacy concerns 
when requesting a report, consumers could verify their identities by using a credit 
card, as other applicants do, but then not have the card billed. 

• Require creditors to identify any offer of credit at less than the most fa- 
vorable terms as an “adverse offer,” as has been called for by the Federal 
Trade Commission. This would include prescreened “subprime” mortgage offers or 
credit cards solicitations that are based on negative or less than favorable credit 
information. As is well known, the subprime credit industry has boomed in the 
past decade by offering borrowers with blemished or limited credit histories mort- 
gage loans, car loans, and credit cards at higher rates and less favorable terms 
than offered to their “prime” borrowers. As lenders increasingly offer a continuum 
of loans at different rates and terms, it is more important than ever that con- 
sumers have the ability to exercise their FCRA rights to ensure that the adverse 
credit information is correct. In the world of “risk-based” pricing, borrowers 
should know that they are being targeted because of their less-than-optimal credit 
history and should be offered the opportunity to check their credit history and 
change any information that is not accurate or complete. Furthermore, as stated 
above, many consumers are unwittingly giving up their FCRA rights because they 
are accepting loans that are legally considered “counteroffers.” 

• Consumers should also be able to obtain directly from the lender a free 
copy of the “subscriber” report and score used to deny credit or offer it 
under less favorable terms. This report includes the actual report data by the 
lender used to take an adverse credit action. Employment applicants already have 
a similar right under FCRA but borrowers currently do not. Easy access to this 
information will also provide a powerful incentive for credit bureaus to improve 
accuracy, as well as giving consumers a helpful educational tool. Consumers face 
two problems when they request a credit report (and score) from a credit bureau. 
First, any adverse actions previously taken were based on a subscriber credit re- 
port provided to the lender. The subscriber report is often provided based on a 
limited number of matching data points and is more likely to contain inaccurate 
or mismerged information about other consumers than a report requested by a 
consumer, since a consumer must provide a detailed match of name, address, and 
Social Security number. Second, a score derived from that consumer report will 
probably differ from the score the subscriber obtained from the less accurate re- 
port. Upon receiving the subscriber report, consumers would then be allowed to 
identify any errors or out-of-date information, provide documentation, and be 
reevaluated for the loan or for prime rates. The additional cost to lenders and 
businesses of providing these reports immediately would be minimal. Since they 
already possess the report in paper or electronic form, they would merely have 
to copy or print this report. 

• Provide consumers with detailed explanations as to why credit is denied 
or less-than-favorable terms are offered. In its study of credit score accuracy 
CFA found that approximately 7 in 10 credit reports indicated that the primary 
factor contributing to the credit score was “serious delinquency,” “derogatory pub- 
lic record,” “collection filed,” or some combination of these factors. This generic 
and extremely vague information provided by creditors when they take an adverse 
credit action is too general to be helpful, especially for most subprime borrowers, 
who by definition have some credit blemishes. Instead, lenders should be required 
to identify any specific entries (trade lines) that are lowering a consumer’s score 


^Consumer Federation of America and National Credit Reporting Association. Credit Score 
Accuracy and Implications for Consumers. December 2002. Available at: http: 1 1 www. consumer 
fed.org ! 121 702CFA NCRA Credit Score Report Final.pdf 
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and indicate the impact on the consumer (either the point value deducted for that 
entry or the proportional impact relative to other derogatory entries.) 

• Require ereditors and other data furnishers to notify consumers any time 
derogatory information has heen placed on a credit report. The State of 
Colorado requires credit bureaus to provide consumers who have had any negative 
information added to their reports with annual notification of their rights. This 
would offer consumers the opportunity to check the accuracy of this information 
when it is submitted, as opposed to finding out the next time the consumer ap- 
plies for credit and is turned down or offered a high interest rate. 

Second, allow consumers to quickly and easily question the accuracy and 
completeness of information in credit reports. 

• Give consumers an FCRA right to contact a furnisher directly to initiate 
reinvestigation, as the Federal Trade Commission has recommended. As stated 
above, furnishers have no legal obligation under current law to investigate a cred- 
it reporting error, if contacted by the consumer. Under the FCRA, credit fur- 
nishers only have a legal obligation to respond to a reinvestigation begun by a 
credit bureau, at the request of a consumer. As a result, consumers often face 
longer delays and more “finger pointing” when they contact their lender about a 
credit reporting problem first. The law should make it clear that furnishers have 
an obligation to respond to their customers if a credit reporting complaint is 
made. 

• Shorten the deadlines hy which creditors must respond to consumer dis- 
putes about credit information. Currently, the FCRA provides creditors with 
30 days to respond to a dispute; 45 days if the consumer submits additional docu- 
mentation about the dispute. In the age of “instant credit” and 3-day credit re- 
scoring by credit reporting resellers, these deadlines are much too long. By the 
time the consumer hears back from the credit bureau about the outcome of the 
dispute, he or she might have lost a home loan (and the home) or submitted to 
a loan at a higher rate than he or she was entitled to. Given how fast credit deci- 
sions are now made, resolution deadlines of 10 days (15 days if the consumer sub- 
mits additional information) do not seem unreasonable. Credit bureaus have 
shown in recent years that extremely quick reinvestigations are possible. The 
credit bureaus have a well-documented system that provides “concierge” services 
for certain classes of consumers. VIP’s and consumers who are suing the bureaus 
generally can get complaints resolved more quickly. The most efficient reinves- 
tigation systems are provided for consumers working with certain mortgage enti- 
ties, where rapid rescoring can gain a correction in 24-48 hours. 

• Require the FTC and other regulators to fully enforee the existing re- 
quirement that eredit bureaus eonsider all information relevant to a con- 
sumer’s dispute, including information provided by the consumer, and to require 
bureaus to reject findings of so-called furnisher reinvestigation that conflict with 
such relevant information provided by the consumer. This Committee has already 
heard testimony, from Evan Hendricks and others, that credit bureaus and fur- 
nishers are failing to conduct reinvestigations in a reasonable manner. 

Third, give consumers better private enforcement rights, since the agencies 
aren’t adequately enforcing the accuracy provisions of the law: 

• Give consumers the right to go to a court and seek injunctive relief to 

stop a credit bureau from selling faulty credit reports about them. 

• Give consumers the right to seek minimum statutory damages of $100 to 
$1,000 per violation of the FCRA, as other consumer laws provide, so that 
they do not have to prove their actual damages to a court. This provision is espe- 
cially critical for identity theft victims, who often spend hundreds of hours over 
a period of years trying to clear their good names. While the cost of emotional 
distress is significantly greater than $100 to $1000, the threat of specific damages 
would be a powerful incentive to force creditors and credit bureaus to clean up 
the credit reporting system’s accuracy. 

Improving Overall Financial Literacy 

The results of this survey also point to the need for a long-term strate^ to boost 
general financial awareness and to improve financial decisionmaking by Americans. 
There has never been a greater need to advance financial education. 

The financial education needs of the least affluent and well-educated Americans 
are especially pressing, in part because recent changes in the financial services mar- 
ketplace have increased the vulnerability of these households. In particular, the dra- 
matic expansion of high-cost and sometimes predatory lending to moderate and 
lower-income Americans in the last decade has put many of these people at great 
financial risk. Because these individuals lack financial resources and often are 
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charged high prices, they cannot afford to make poor financial choices. But because 
of low general and financial literacy levels, they often have difficulty making smart 
financial decisions, in part because they are especially vulnerable to abusive seller 
practices. 

There is no large population that would benefit more from improved financial edu- 
cation than the tens of millions of the least affluent and well-educated Americans. 
In 1998, 37 percent of all households had incomes under $25,000. With the excep- 
tion of older persons who had paid off home mortgages, these households had accu- 
mulated few assets. In 1998, according to the Federal Reserve Board’s Survey of 
Consumer Finances, most of these least affluent households had net financial assets 
(excluding home equity) of less than $1,000. Moreover, between 1995 and 1998, a 
time of rising household incomes, the net worth of lower-income households actually 
declined. 

For lower-income households with few discretionary financial resources, failing to 
adequately budget expenditures may pressure these consumers into taking out ex- 
pensive credit card or payday loans. Mistakenly purchasing a predatory mortgage 
loan could cost them most of their economic assets. 

These households also need to make smart buying decisions because they tend to 
be charged higher prices than more affluent families: Higher homeowner and auto 
insurance rates because they live in riskier neighborhoods; higher loan rates be- 
cause of their low and often unstable incomes; higher furniture and appliance prices 
from neighborhood merchants that lack economies of scale and face relatively high 
costs of doing business; and higher food prices in their many neighborhoods without 
stores from major supermarket chains. Lower-income families are also faced with 
higher prices for basic banking services and they lack access to essential savings 
options. Lower-income households with low literacy levels are especially vulnerable 
to seller abuse. Consumers who do not understand percentages may well find it im- 
possible to understand the costs of mortgage, home equity, installment, credit card, 
payday, and other high-cost loans. Individuals who do not read well may find it dif- 
ficult to check whether the oral promises of salespersons were written into con- 
tracts. And, those who do not write fluently are limited in their ability to resolve 
problems by writing to merchants or complaint agencies. Consumers who do not 
speak, read, or write English well face special challenges obtaining good value in 
their purchases. 

Over the past decade, the financial vulnerability of low- and moderate-income 
households has increased simply because of the dramatic expansion of the avail- 
ability of credit. The loans that subjected the greatest number of Americans to fi- 
nancial risk were made with credit cards. From 1990 to 2000, fueled by billions of 
mail solicitations annually and low minimum monthly payments of 2-3 percent, 
credit card debt outstanding more than tripled from about $200 billion to more than 
$600 billion. Just as significantly, the credit lines made available just to bank card- 
holders rose to well over $2 trillion. By the middle of the decade, having saturated 
upper- and middle-class markets, issuers began marketing to lower-income house- 
holds. By the end of the decade, an estimated 80 percent of all households carried 
at least one credit card. Independent experts agree that expanding credit card debt 
has been the principal reason for rising consumer bankruptcies. 

Also worrisome has been the expansion of high-priced mortgage loans and 
stratospherically priced smaller consumer loans. In the 1990’s, creditors began to 
aggressively market subprime mortgage loans carrying interest rates greater than 
10 percent and higher fees than those charged on conventional mortgage loans. By 
1999, the volume of subprime mortgage loans peaked at $160 billion. Mortgage bor- 
rowers in low-income neighborhoods were three times more likely to have subprime 
loans than mortgage borrowers in high-income neighborhoods. A significant minor- 
ity of these subprime borrowers would have qualified for much less expensive con- 
ventional mortgage loans. Some of these borrowers were victimized by exorbitantly 
priced and frequently refinanced predatory loans that “stripped equity” from the 
homes of many lower-income households. 

The 1990’s also saw explosive growth in predatory small loans — payday loans, car 
title pawn, rent-to-own, and refund anticipation loans — typically carrying effective 
interest rates in triple digits. The Fannie Mae Foundation estimates that these 
“loans” annually involve 280 million transactions worth $78 billion and carr 3 dng 
$5.5 billion in fees. The typical purchaser of these financial products has income in 
the $20,000 to $30,000 range with a disproportionate number being women. 

Both proper regulation and education are necessary to ensure that lower and 
moderate income Americans are not subject to abusive lending practices and that 
they have the knowledge to make effective decisions in an increasingly complex fi- 
nancial services marketplace. 
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Thankfully, Senators Sarbanes, Shelby, Stabenow, Enzi, and Akaka have all 
shown a great deal of interest in improving financial education efforts in this coun- 
try. For example. Senator Sarbanes’ recently proposed an idea that has a lot of 
merit: Creating a Financial Literacy and Education and Coordinating Committee 
within the Department of the Treasury. 

While many worthwhile financial education programs exist, they are not well co- 
ordinated, effectively reach only a small minority of the population, and do not 
reflect any broad, compelling vision. Many focus only on increasing consumer knowl- 
edge of how to best operate in the financial services marketplace, and not on actu- 
ally changing consumer behavior to improve decisions about spending, saving, and 
the use of credit. Moreover, there is no clear consensus about how to effectively pro- 
vide financial education, especially to those who have completed their secondary 
education and to those with low literacy levels. What is most needed is a com- 
prehensive needs assessment and plan to guide and inspire financial educators and 
their supporters. Moreover, for any comprehensive plan to win broad public and pri- 
vate support and participation, the Federal Government must provide leadership. 
Both a comprehensive strategy and Federal leadership (not ownership) are called for 
in the Sarbanes’ bill. Such an approach could also convince a broad array of govern- 
ment, business, and nonprofit groups to work together to persuade the Nation to 
implement that plan. 

We commend Senator Sarbanes for proposing a comprehensive and achievable vi- 
sion for improving financial awareness and decisionmaking. We look forward to 
working with him. Senator Shelby, and the other Senators I mentioned to improve 
financial education in this country. 

Conclusion 

I applaud the Chairman, the Ranking Member, and all the Members of this Com- 
mittee for the exhaustive and informative set of hearings that you have conducted 
about the state of the Fair Credit Reporting Act. As the Committee begins writing 
legislation to deal with the problems that have been identified in these hearings, 
I urge you not to overlook what we heard from Americans in our survey. Consumers 
want a credit reporting system that is more accurate, more transparent, and that 
better protects their privacy. I look forward to working with the Committee to 
achieve these important goals. 


PREPARED STATEMENT OF CHERI ST. JOHN* 

Vice President of Global Scoring Solutions, Fair Isaac Corporation 

July 29, 2003 

Introduction 

Mr. Chairman and Members of the Committee, my name is Cheri St. John. I am 
the Vice President of Global Scoring Solutions for Fair Isaac Corporation. Thank 
you for the opportunity to testify before you today about Fair Isaac’s leadership in 
improving the financial literacy of American consumers, specifically with respect to 
Fair Isaac’s efforts to empower consumers by providing them with actionable infor- 
mation about the credit scores that lenders use to make credit decisions. 

Fair Isaac Corporation 

Fair Isaac Corporation is the preeminent provider of creative analytics that 
unlock value for people, businesses, and industries. Founded in 1956, Fair Isaac 
helps thousands of companies in over 60 countries acquire customers more effi- 
ciently, increase customer value, reduce fraud and credit losses, lower operating 
expenses, and make more credit available to more people. Fair Isaac pioneered the 
development of statistically based credit risk evaluation systems, commonly called 
“credit scoring systems,” and is the world’s leading developer of those systems. 
Thousands of credit grantors use broad-based credit scores commonly known as 
“FICO® scores” generated by Fair Isaac-developed scoring systems implemented at 
the national credit reporting agencies. Fair Isaac has also developed custom scoring 
systems for hundreds of the Nation’s leading banks, credit card issuers, finance com- 
panies, retailers, insurance companies, and telecommunication providers. 

There are many different kinds of credit scores. The most well known are the 
broad-based credit risk scores developed by Fair Isaac known as FICO scores and 


*A11 attachments referenced in Ms. St. John’s prepared statement are held in Senate Banking 
Committee files. 
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widely distributed to lenders by the three national credit bureaus under the brand 
names: Beacon from Equifax; Empirica from TransUnion; and, the Experian/Fair 
Isaac Risk Model from Experian. Indeed, there are several versions of the above 
EICO scores available because some lenders adopt newly developed versions more 
quickly than other lenders. There are also broad-based credit scores developed by 
each of the three bureaus and from other third-party developers. There are custom 
models developed for use by individual lenders. There are also credit score models 
developed for specific industries, such as the mortgage, automobile, and tele- 
communications industries. Einally, there are credit scores distributed primarily to 
the consumer market. 

Over the last 40 years credit scoring has become an important part of most credit 
decisions, such that Fair Isaac believes some form of credit scoring is now used in 
the majority of consumer credit decisions. A FICO Score is a 3-digit number that 
tells lenders how likely a borrower is to repay as agreed. To develop the models that 
g:enerate the credit scores. Fair Isaac analyzes anonymous credit report data to sta- 
tistically determine what factors are most predictive of future credit performance. 
Factors that do not have predictive value and factors that by law cannot be used 
in the credit decision are excluded from consideration. FICO scores use information 
from consumer credit reports to provide a snapshot of the credit risk at a particular 
point in time. Scores can change over time, as subsequent credit risk predictions re- 
flect changes in underlying behaviors. 

Fair Isaac is a leading developer of insurance risk scores. Over 350 insurance 
companies use Fair Isaac insurance scores that they obtain through national credit 
reporting agencies. Although insurance scores utilize credit data, they differ from 
credit scores in that insurance scores are developed based on insurance premium 
and loss history and predict future insurance loss ratio relativity. Like credit scores, 
insurance scores do not consider a person’s income, marital status, gender, ethnic 
group, religion, nationality, or neighborhood, and the scores are applied consistently 
from one consumer to the next. A strong statistical correlation has been repeatedly 
demonstrated between credit data and insurance loss ratio, ^ and insurance scores 
have become a valuable component in determining insurability and the rate as- 
signed. Insurers use insurance scores to accelerate their processing for applicants 
and renewal shareholders, to concentrate their additional underwriting attention on 
higher-risk individuals, and to better manage operational strategies. Consumers 
benefit from lower rates. Insurers have stated that 60-75 percent of their policy- 
holders pay lower premiums because of insurance scoring. Fair Isaac has been sup- 
portive of the efforts of insurance score users to educate consumers and agents 
about insurance scoring.^ 

With Credit Scoring, More People Get Credit, They Get It Faster, and 
It’s More Affordahle 

FICO scores mean more people have access to credit. Credit scores allow lenders 
to better assess their risk and tailor credit for each consumer’s needs. FICO scores 
are used in almost every sector of the Nation’s economy: For mortgages, credit 
cards, auto loans, personal loans, even cell phone service. More people can get credit 
regardless of their credit history because credit scores allow lenders to safely assess 
and account for the risk of consumers who have no existing relationship with the 
lender, who have never entered the lender’s branches, and who may have been 
turned away in the past by other lenders. Lenders use scores not only to evaluate 
applications, but also to manage the credit needs of existing customers by extending 
additional credit or helping consumers avoid overextending themselves. FICO scores 
are also used by lenders and securities firms as to aid securitization of credit port- 
folios which provides lenders the capital they need to make credit available to more 
consumers. FICO scores are accepted, reliable,® and trusted to the point that even 
regulators including Federal bank examiners, and security rating agencies, use 
them to help ensure the safety and soundness of the financial system.'^ 

FICO scores mean people get credit faster. “Instant credit” at a retailer, an auto 
dealer, over the phone, or on the Internet would not be possible without credit 
scores. Even mortgage loans that used to take weeks can now be done in minutes. 
Among the tremendous lending advances in the United States over the last decade 


^ See, Predictiveness of Credit History for Insurance Loss Ratio Relativities, October 1999; At- 
tachment 1: A Statistical Analysis of the Relationship Between Credit History and Insurance 
Losses, Bureau of Business Research (McCombs School of Business) at the University of Texas, 
March, 2003 available at http:! I www.utexas.edu I depts I bbr / bbr creditstudy.pdf 
^See e.g., Answers to Your Questions About Insurance Bureau Scores, Attachment 2. 

® See Attachment 3, A Clarification of the Consumer Federation of America's Observations 
About Credit Score Accuracy. 

'^See Attachment 4 for examples of Federal agencies that use FICO scores. 
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has been the streamlining of the lending process, so that credit approvals — not just 
on credit cards but on installment loans, mortgages, home equity lines of credit, and 
even commercial loans to small businesses — can be made faster with less manual 
review, less paperwork, and fewer data requests. All of this has occurred while lend- 
ers have not only preserved but also strengthened their visibility and control over 
their risk exposure. 

FICO scores mean people pay less for their credit. Scores make credit more afford- 
able by reducing the cost of evaluating applications, reducing loan losses, reducing 
the cost of managing credit portfolios, reducing marketing costs with prescreening, 
and cutting the cost of capital with securitization. This efficient flow of credit and 
capital has a large part to play in the continued robustness of the American econ- 
omy. By enabling lenders to extend credit quickly while managing their risk, credit 
reports and scores have made credit more accessible, at lower rates, to more people. 

Lenders must make a credit decision, and they must predict the future in doing 
so. Lenders can use a variety of decision making techniques to predict the future, 
ranging from a simple subjective evaluation of application and credit history infor- 
mation by a loan officer, to predictive technologies, including credit scoring. When 
a creditor switches from judgmental decisions to scoring, it is common to see a 20- 
30 percent increase in the number of applicants accepted with no increase in the 
loss rate. Lenders should use all the information that is legally, economically, and 
efficiently available to make the best and fairest possible decision for each indi- 
vidual with whom they do business. FICO scores, when used properly, make a tre- 
mendous contribution in doing just that. FICO scores use only legal data as inputs, 
and only those factors proven to be predictive of credit risk. Scores are also more 
consistent from consumer to consumer because they assess the same factors the 
same way, each time. 

Studies have concluded that the same Fair Isaac credit score indicates the same 
level of risk regardless of the income level of the consumer or whether the consumer 
resides in an area with a high percentage of minority residents, with differences 
consistently favoring the low- to moderate-income (LMI) and high minority area 
(HMA) applicants.® Those same studies indicate that credit scoring is a far more 
predictive screen for both the LMI and HMA applicants than is judgmental decision 
making. Finally, the multiple scorecard systems developed by Fair Isaac and resi- 
dent at the three main U.S. credit bureaus were proven to be more predictive than 
a single scorecard developed for the HMA population for the study. 

Fair Isaac credit scores transform the economics and efficiency of the credit deci- 
sion to allow all relevant information to be brought to bear so that no information 
that is favorable to an individual is omitted from the decision process. Credit scoring 
scientifically, and therefore fairly, balances and weighs positive information along 
with any negative information in credit reports. In essence, full positive credit re- 
porting and scoring have “democratized” credit granting — information about all con- 
sumers is available to all lenders for a fair evaluation. Scoring has transformed 
credit granting so that it is no longer simply based on who you know. 

Financial Education and Consumer Empowerment Depend Upon 
Actionable Information About the Credit Scores That Lenders Use 

Fair Isaac Supports Consumer Education and Empowerment 

When lenders first began using credit scoring, Fair Isaac provided both lenders 
and regulators the information and training needed for effective score tracking and 
oversight. Lenders have always been provided with the top four reasons with every 
credit score, in order of their importance to the score. As credit scoring use has 
grown. Fair Isaac has responded by providing consumers with the information they 
need to understand credit scoring and use it to take control of their credit health. 
Fair Isaac has published consumer booklets on credit scoring since the early 1990’s 
on its own and in conjunction with others such as the FTC. Free information has 
also been available to consumers at www.myFICO.com, since its inception. Con- 
sumers interested in learning more about their individual score can access 
www.myFICO.com to get their own FICO Score, accompanied by the underl3ring 
credit report, and a complete explanation of their personal FICO score for $12.95. 
Fair Isaac has given consumers a place in the credit reporting process by pioneering 
consumer credit empowerment with its myFICO.com score explanation. Millions of 
consumers have already taken steps to control their credit lives by using 
myFICO.com to obtain informative, actionable credit-information services including 


® See, The Effectiveness of Scoring on Low-to-Moderate Income and High Minority Area Popu- 
lations, a Fair Isaac Paper dated August, 1997, Attachment 5. 
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the FICO scores that lenders use, and to help improve and protect their overall fi- 
nancial health. 

Explanations of Adverse Action 

Consumers, by law, are provided with the key reasons behind their score, when 
those score(s) were a factor in a decision resulting in an adverse action. These rea- 
son codes provided with the FICO score can be used by the lender as part of its 
explanation to the consumer of any adverse action taken and what the consumer 
can do to improve their outlook for being approved for credit in the future. 

Evolution of Consumer Credit Score Education 

FICO scores first became available commercially from all three national credit re- 
porting agencies in 1991. Prior to the mortgage industry’s embrace of credit risk 
scoring technology in the mid-1990’s, U.S. consumers generally were not aware of 
this business decision tool and it was not as widely used. This started to change 
in 1995 when Fannie Mae and Freddie Mac approved the use of credit risk scoring 
by mortgage lenders. Their approval prompted an increasing number of mortgage 
lenders and mortgage brokers to use credit risk scores in loan underwriting. Other 
industries began relying more heavily on FICO scores as well, such as auto lenders 
and bankcard issuers. Through consumers’ interaction with brokers and lenders, the 
public became more aware of credit scores. The news media also began reporting 
on this as yet relatively unknown lender risk evaluation tool. 

Five years ago, market research showed an initiative to educate consumers about 
credit scoring was likely to fail due to lack of consumer interest. Once the wide use 
of credit scores made consumers receptive, however. Fair Isaac launched its con- 
sumer education initiative that has made it a leader in promoting financial literacy 
for all consumers. 

We believe it is instructive to briefly review the development of consumer credit 
education to show how Fair Isaac continues to respond to the need for financial lit- 
eracy as consumers’ awareness grows. The one constant has been Fair Isaac’s com- 
mitment to the disclosure of credit scores in a way that equips the consumer with 
accurate, actionable information while avoiding the confusion that can be created 
from a misunderstanding of a complex topic. 

Initiative to Demystify FICO Scores 

On June 8, 2000, Fair Isaac announced its public disclosure of all the factors used 
in its FICO credit bureau risk scores. The list was made publicly available on the 
company’s website for free, and remains free and accessible today at http:! / www.my 
fico.com ! my fico / CreditCentral / ScoreConsiders.asp. 

FICO Guide 

By late October 2000, Fair Isaac had developed and launched an online service 
called FICO Guide. FICO Guide provided a FiCO score explanation when a lender 
or broker provided the consumer with his or her FICO score, the accompanying rea- 
son codes, and the name of the credit reporting agency that had calculated the 
score. FICO Guide was developed to offer consumers, and the lenders and brokers 
who served them, an interim score explanation service. While the Fair Isaac pur- 
sued several options for disclosing FICO scores directly to consumers FICO Guide 
was phased out shortly after Fair Isaac launched its score disclosure and expla- 
nation service 5 months later via myFICO.com. 

The First Online Consumer Service That Provides FICO Scores 
and Explanation Directly To Consumers 

On January 11, 2001, Fair Isaac and Equifax announced their agreement to cre- 
ate the first service that explains and delivers credit scores directly to consumers, 
accompanied by the underljdng Equifax credit report and a score explanation by 
Eair Isaac. In their announcement, Eair Isaac explained, “We will provide the tools 
to not only review an individual’s credit information, but to help them understand 
how that data may be analyzed to predict the risk associated with a credit applica- 
tion.” The companies began offering their new service online on March 19, 2001. 

Personalized FICO Score Simulation 

On May 21, 2002, Fair Isaac revolutionized consumer credit education when it in- 
troduced its FICO Score Simulator on www.my FICO. com, as a free service for cus- 
tomers who purchase a score explanation service.® The FICO Score Simulator uses 
consumers’ own credit information and FICO scores to help them see how specific 


sample of the FICO Score Simulator is accessible at http: 1 1 www.myfico.com I Content I 
Samples I Sample ScoreSimulator.asp?ReportID=l&ProductID=l. 
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future actions they might take could change their FICO score, and learn what’s 
most important to achieve and maintain good credit health. Consumers can see how 
their FICO scores would respond to any of a variety of actions ranging from paying 
all their hills on time for the next month, to declaring personal bankruptcy. 

Fair Isaac Provides Considerable Free Credit Score Educational Information 
As noted above. Fair Isaac provides consumers with free educational information 
on FICO scoring directly from its website, and in booklet form.'^ Free content on 
www.myFICO.com includes a weighting of the credit report factors evaluated by the 
FICO score so that consumers know what events or behavior has the greatest influ- 
ence on the scores in general. The following is sample of free content, taken directly 
from www.myFICO.com.^ 


See Attachment 6 available free at http:! i www.myfico.com i Offers i RequestOffer.asp. 
® Accessible at http:! I www.myfico.com / myfico I CreditCentral I ScoreConsiders. asp. 
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FiCO Scores are calculated from a lot of different CTedIt data In your credit report. This data can be grouped 
into five categories as outlined below. The percentages in the chart reflect how important each of the 
categories is in determining your score. 



These percentages are based on the importance of the five categories for the general population. For 
particular groups - for example, people who have not been using credit long - the importance of these 
categories may be somewhat different. 


jPayment History 

Account payment information on specific types of accounts (credit cards, retail accounts, 
installment loans, finance company accounts, mortgage, etc.) 

Presence of adverse public records (bankruptcy, judgements, suits, liens, wage attachments, etc.), 
collection items, and/or delinquency (past due items) 

Severity of delinquency (how long past due) 

Amount past due on delinquent accounts or collection items 

Time since (recency of) past due items (delinquency), adverse public records (if any), or collection 
items (if any) 

Number of past due items on file 
Number of accounts paid as agreed 

^mounts Owed 


Amount owing on accounts 
Amount owing on specific types of accounts 
Lack of a specific type of balance, in some cases 
Number of accounts with balances 

Proportion of credit lines used (proportion of balances to total credit limits on certain types of 
revolving accounts) 

Proportion of installment loan amounts still owing (proportion of balance to original loan amount on 
certain types of installment loans) 

Length of Credit History 


• Time since accounts opened 

• Time since accounts opened, by specific type of account 
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• Time since account activity 

New Credit 


• Number of recently opened accounts, and proportion of accounts that are recently opened, by type 
of account 

• Number of recent credit inquiries 

• Time since recent account opening(s). by type of account 

• Time since credit inquiry(s) 

• Re-establishment of positive credit history following past payment problems 

Types of Credit Used 


• Number of (presence, prevalence, and recent information on) various types of accounts (credit 
cards, retail accounts, installment loans, mortgage, consumer finance accounts, etc.) 

Please note that: 

• A score takes into consideration ail these categories of information, not just one or two. 

No one piece of information or factor alone will determine your score. 

• The importance of any factor depends on the overall information in your credit report. 

For some people, a given factor may be more important than for someone else with a different 
credit history. In addition, as the information in your credit report changes, so does the importance 
of any factor in determining your score. Thus, it's impossible to say exactly how important any 
single factor is in determining your score - even the levels of importance shown here are for the 
general population, and will be different for different credit profiles. What's important is the mix of 
information, which varies from person to person, and for any one person over time. 

• Your FICO score only looks at information in your credit report. 

However, lenders look at many things when making a credit decision including your income, how 
long you have worked at your present job and the kind of credit you are requesting. 

• Your score considers both positive and negative Information In your credit report. 

Late payments will lower your score, but establishing or re-establishing a good track record of 
making payments on time will raise your score. 
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The website’s educational information also lists and discusses the kinds of infor- 
mation NOT included in calculating FICO scores.® These extend well beyond the 
prohibited factors listed in the Equal Credit Opportunity Act. 


What's Not m Your Score ^ Er?>ail This 


FICO scores consider a wide range of information on your credit report. However, they do not consider: 

• Your race, color, religion, national origin, sex and marital status. 

US law prohibits credit scoring from considering these facts, as well as any receipt of public 
assistance, or the exercise of any consumer right under the Consumer Credit Protection Act. 

• Your age. 

Other types of scores may consider your age, but FICO scores don't. 

• Your salary, occupation, title, employer, date employed or employment history. 

Lenders may consider this Information, however, as may other types of scores. 

• Where you live. 

• Any interest rate being charged on a particular credit card or other account. 

• Any items reported as child/family support obligations or rental agreements. 

• Certain types of inquiries (requests for your credit report). 

The score does not count "consumer-initiated" inquiries - requests you have made for your credit 
report, in order to check it. It also does not count "promotional inquiries" - requests made by 
lenders in order to make you a "pre-approved" credit offer - or "administrative inquiries" - requests 
made by lenders to review your account with them. Requests that are marked as coming from 
employers are not counted either. 

• Any information not found in your credit report. 

• Any information that is not proven to be predictive of future credit performance. 

• Whether or not you are participating in a credit counseling of any kind. 


The website also provides free advice on actions consumers should take — or avoid 
taking — to improve FICO scores over time.^® 


^Accessible at http:! I www.myfico.com I myfico I CreditCentral I ScoringWorks I FICOIgnores.asp. 
Accessible at http:! I www.myfico.com I myfico I CreditCentral I ScoreConsiders I Tips I Amounts 
OwedTip.asp. 
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iifiprovisig Your Score ®,S!illJBS 


It's important to note that raising your score is a bit like losing weight: It takes time and 
there is no quick fix. In fact, quick-fix efforts can backfire. The best advice is to manage 
credit responsibly over time. To see how much money you can save by just following 
these tips and raising your score, click here . 

Payment History Tips 

• Pay your bills on time. 

Delinquent payments and collections can have a major negative impact on your score. 

• If you have missed payments, get current and stay current. 

The longer you pay your bills on time, the better your score. 

• Be aware that paying off a collection account will not remove It from your credit report. 

It will stay on your report for seven years. 

• If you are having trouble making ends meet, contact your creditors or see a legitimate credit 
counselor. 

This won't improve your score immediately, but if you can begin to manage your credit and pay on 
time, your score will get better over time. 

Amounts Owed Tips 

• Keep balances low on credit cards and other "revolving credit". 

High outstanding debt can affect a score. 

• Pay off debt rather than moving it around. 

The most effective way to improve your score in this area is by paying down your revolving credit. 

In fact, owing the same amount but having fewer open accounts may lower your score. 

• Don't close unused credit cards as a short-term strategy to raise your score. 

• Don't open a number of new credit cards that you don't need, just to increase your available 
credit. 

This approach could backfire and actually lower score. 

Length of Credit History Tips 

• If you have been managing credit for a short time, don't open a lot of new accounts too 
rapidly. 

New accounts will lower your average account age, which will have a larger effect on your score if 
you don't have a lot of other credit information. Also, rapid account buildup can look risky if you are 
a nev; credit user. 

New Credit Tips 

• Do your rate shopping for a given loan within a focused period of time. 


FICO® scores distinguish between a search for a single loan and a search for many new credit 
lines, in part by the length of time over which inquiries occur. 

• Re-establish your credit history if you have had problems. 

Opening new accounts responsibly and paying them off on time will raise your score in the long 
term. 

• Note that it's OK to request and check your own credit report. 

This won't affect your score, as long as you order your credit report directly from the credit 
reporting agency or through an organization authorized to provide credit reports to consumers. 

Types of Credit Use Tips 

• Apply for and open new credit accounts only as needed. 

Don't open accounts just to have a better credit mix - it probably won't raise your score. 

• Have credit cards - but manage them responsibly. 

In general, having credit cards and installment loans (and paying timely payments) will raise your 
score. Someone with no credit cards, for example, tends to be higher risk than someone who has 
managed credit cards responsibly. 

• Note that closing an account doesn't make it go away. 

A closed account will still show up on your credit report, and may be considered by the score. 
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Other educational information offered free to consumers on the website includes: 
Ways in which credit scores help consumers; information on credit reports and what 
to do if a credit report error is suspected; over 50 different financial calculators to 
help consumers manage their money; and, an extensive section of Frequently Asked 
Questions regarding credit scoring and the site’s consumer products such as: 


FICO® Scores 

What is a FICO score? 

How can I improve my FICO score? 

Whats the most irriportant factor in a Score? 

Do insurance companies look at FiCO credit risk scores? 
What do FiCO scores ignore? 

What is a good FiCO score? 

How often does the score change? 

How are the FICO scores caicuiated? 

What are the highest and lowest FICO scores? 

Why do lenders use FiCO scores? 

Does everyone have a FiCO score? 

What is a SEACON score? 

Will ordering my FiCO® score cause it to drop? 

Will rny score actually change over time? 
is my score more likely to go up or down? 


Fair Isaac has also pioneered new tools to help consumers better understand what 
influences their scores and how their scores affect lender decisions. On March 6, 
2002, the company introduced a free interest-rate service on www.myFICO.com that 
matches consumer FICO scores with current interest rates currently charged by 
lenders for 18 different types of mortgage and auto loans. The service helps con- 
sumers quickly understand how getting a better FICO score can translate into more 
attractive credit terms and significant dollar savings over time. The interest rate in- 
formation is collected daily by Informa Research Services, Inc. 

FICO Scores are Readily Available to Consumers 

Today, Fair Isaac provides FICO® scores, directly to consumers through several 
distribution channels. These scores are always accompanied by key supplementary 
information that helps the consumer understand and use the score: The consumer’s 
underlying credit report and Fair Isaac’s personalized score analysis including the 
score range, where the consumer’s score falls on that range, what factors contrib- 
uted most to their particular score and how to improve their score given those fac- 
tors over time. At www.myFICO.com, consumers can get their FICO score calculated 
from data in their credit report provided by any of the three national credit report- 
ing agencies: Equifax, Experian, and TransUnion. For $12.95, the basic service pro- 
vides the consumer’s FICO score. Fair Isaac’s personalized explanation of the score 
and suggestions for improving it over time, the underlying credit report information 
from which the score was calculated, and access to the FICO Score Simulator. 

In addition, the website offers several other services based on the consumer’s 
FICO score: 

• FICO Saver for Homebuyers shows consumers how their FICO score and other 
information will likely be evaluated by mortgage lenders, and helps consumers re- 
alistically assess the maximum loan amount they can comfortably handle. 

• 3 Bureau Report with FICO score provides consumers with all three credit reports 
plus their FICO score calculated by TransUnion and Fair Isaac’s score expla- 
nation, for a complete view of their credit history. 

• Equifax Credit Watch is the comprehensive credit-monitoring service for con- 
sumers concerned about the risk of identity theft. 

• myFICO Credit Advantage helps consumers track changes in their FICO score 
and credit report over one year. 

Fair Isaac has also worked with the credit reporting agencies such that those 
credit reporting agencies can also provide FICO scores directly to consumers, accom- 
panied by the underlying credit report and Fair Isaac’s personalized explanation 
and suggestions for improving the score over time. Today, Equifeix and TransUnion 
both offer FICO scores and explanation service via their websites as well. 

FICO Score Explanation by Mail 

Fair Isaac has expanded its consumer education initiative to make FICO score 
education available to consumers who may not have convenient access or who 


Accessible at http:! I www.myfico.com / my fico j FAQ. asp. 

Accessible at http:! I www.myfico.com / my fico I CreditCentral I LoanRates. asp. 
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choose not to obtain it over the Internet. Fair Isaac collaborates with Intersections, 
a company that provides credit information and credit-monitoring services to con- 
sumers both online and via U.S. Mail. This includes a 3-in-l credit report that pro- 
vides credit reports from all three bureaus, the consumer’s FICO score calculated 
by TransUnion, and Fair Isaac’s score explanation. 

In addition. Fair Isaac also works with a variety of businesses to create new chan- 
nels that consumers can use to access FICO score-based consumer services and in- 
formation. These businesses include some of the Nation’s leading financial service 
providers, as well as financial management solution providers such as Quicken.com, 
and nonprofit credit counseling organizations such as Springboard and Consumer 
Credit Counseling Service of Santa Clara and Ventura Counties. 

Alerting the Public to FICO Score Availability 

Even though Fair Isaac has worked diligently to let consumers know what infor- 
mation about FICO scores is available, the biggest challenge remains getting the 
word out. Since June 2000, Fair Isaac has welcomed and encouraged media coverage 
on the importance to consumers of credit scores and Fair Isaac’s efforts to empower 
and educate consumers with scores and related information. The media’s response 
has been extremely helpful to consumers and includes articles and broadcast cov- 
erage in hundreds of outlets including The Wall Street Journal, The New York 
Times, USA TODAY, Newsweek, NBC Network News, National Public Radio, and 
The Today Show. Traffic at the myFICO.com site increases after each significant 
media event. 

On January 26, 2003, Fair Isaac promoted credit score awareness in a television 
commercial on credit scoring aired during the Super Bowl. The educational ad high- 
lighted the importance of credit scores in determining consumer interest rates on 
mortgage and auto loans, and referred viewers to www.myFICO.com for more infor- 
mation, 

In a further effort to increase public awareness, this past May 5-6, Fair Isaac 
hosted numerous consumer advocacy organizations for an intensive discussion on 
credit scoring and the best ways to reach consumers, especially underserved con- 
sumer groups, with credit scoring information that can help them improve their 
overall credit health. Participants included representatives from such organizations 
as Consumer Action, La Raza, and Operation Hope. 

Solutions to Improve Finaneial Literaey 

While there is a whole range of excellent score education material available to 
consumers today, there are improvements that can be made to solve problems that 
are inhibiting greater financial literacy of American consumers. 

Problem: Scores that are not commonly used by lenders are marketed to 
consumers looking for information to improve their financial literacy. Con- 
sumers, unaware of which credit scores are actually used by lenders to make deci- 
sions about credit, unknowingly purchase information about other credit scores that 
are not commonly used by lenders in making lending decisions. In some cases, pur- 
veyors of these credit score services launch massive marketing campaigns to induce 
consumers to purchase their score services without clearly disclosing the extent to 
which the scores they provide and explain are actually used by lenders. Consumers 
who unknowingly purchase such services may be confused when the credit score 
they purchase is different than the broad-based credit score used by their lender. 
In some cases, steps taken by the consumer to improve another score may not have 
the same effect on the credit score that lenders use. 

To be well-educated, consumers should understand the measure lenders are using, 
and know the score the lender will use to evaluate them. Colleges typically use the 
SAT score to evaluate students who apply for admission. Students know this and 
use that same score to decide where to apply based in part on which colleges might 
accept them. Although a different aptitude test might provide the student with some 
useful information, prospective students get the greatest benefit from knowing their 
own SAT score, empowering them to judge for themselves how they might be viewed 
by a college admissions office. The same is true for credit scores. Educated con- 
sumers should know and understand the credit score that lenders use. 

Solution: Consumer Choice and Education. We believe the solution to this 
problem is to educate consumers so they can make informed choices about pur- 
chasing score explanation services, and can decide what is most useful for them. The 
Senate can help consumers by improving upon the California score disclosure law 


i^The ad can be viewed at httpij / wip2.spacel50.com / my fico / my fico future/. 

Fair Isaac has consistently supported effective score disclosure legislation. Fair Isaac did 
so in testimony in May 2000, before the California State Senate Business and Professions 
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upon which S. 1370 and H.R. 2622 are patterned and promote a policy designed to 
provide the score most likely to help consumers and empower consumers to choose 
the available score that will be most useful to them. 

Problem: Consumers are eonfused because many of the scores provided 
to consumers as mandated by current State laws are not commonly used 
by lenders. Under current California and Colorado score disclosure law, the credit 
reporting agency chooses the credit score it discloses to consumers and, other than 
in the context of a residential real estate transaction, the consumer cannot choose 
to get another score, even if that other score is more useful to the consumer. Two 
of the three national agencies are disclosing their own proprietary scores in compli- 
ance with the California disclosure law and do not give the consumer the option to 
obtain other broad-based credit scores these agencies widely distribute to lenders, 
The proprietary scores these agencies choose to make available to consumers aren’t 
nearly as widely distributed to lenders as others distributed by those agencies. 

Fair Isaac’s consumer support line gets calls from consumers confused by scores 
other than FICO scores that they have obtained. For example, consumers have re- 
ported they have closed a number of accounts, after which the score they have ob- 
tained increased, but their FICO score did not. When we explain to them that the 
score they based their actions on was not a “FICO” score, their reaction is often a 
version of: 

• “What good is that score if it’s not what lenders use?” 

• “This is confusing people.” 

• “Why don’t the bureaus provide the FICO score?” 

In such circumstances, it is harder to help the consumer understand credit scoring 
because the confusion and frustration from the different score must be overcome be- 
fore actionable education can begin. If consumers are given a choice of scores widely 
distributed by the agencies, there will be less confusion and more education. 

Solution: Provide the score that is most likely to be helpful, and give the 
consumer the right to get a different widely distributed score if the con- 
sumer so chooses. The consumer should be equipped with the credit score that can 
best help him or her learn how lenders evaluate credit risk, and empowered to 
choose from the broad-based credit scores that are widely distributed by the bureau. 

Existing legislative proposals should be improved by: 

(1) Adding the name of the credit score and the name of the third-party developer, 
if applicable, to the information about credit scores that credit reporting agencies 
must disclose to the consumer, With this information, the consumer is empowered 
to seek out additional, accurate information about the credit score that matters to 
them. It also empowers the consumer to effectively compare the credit score infor- 
mation it gets from the credit reporting agency to information from lenders and 
other sources. 

(2) When a consumer requests the disclosure of a credit score, the credit reporting 
agency should be required to disclose the broad-based credit score it most widely 
distributes to lenders. In addition, put the consumer in control by allowing him or 
her to request and receive at their choice one of either: (i) A broad-based credit score 
that the credit reporting agency widely distributes to lenders, or (ii) the general 
education credit scores current State law and H.R. 2622 already allow the bureau 
to provide. Protect the credit reporting agency from uncooperative third-party 
score developers by adding another exception that would relieve the agency from the 
obligation to disclose the developer’s score if the third-party developer refuses to au- 
thorize such disclosure at a reasonable fee. Limit the burden on the agency and the 
complexity of the regulation by limiting the disclosure requirement to one model 


Committee regarding S. 1607 has mandated credit score disclosure and eventually became Cali- 
fornia law. Fair Isaac again supported effective score disclosure in September 2000, in testi- 
mony before the U.S. House Subcommittee on Financial Institutions and Consumer Credit, 
including testimony that Fair Isaac, “supports disclosure of scores to consumers provided that 
such disclosure is conducted in a manner that provides meaningful and helpful information to 
consumers.” 

i®Fair Isaac has agreements with one agency authorizing it to disclose FICO scores to con- 
sumers to comply with California and Colorado score disclosure laws. Fair Isaac is willing to 
enter into similar agreements with the other credit reporting agencies. 

i^This requirement could easily be added to the disclosures proposed in Section 3(a) of S. 1370 
and to H.R. 2622. 

I'^This requirement could easily be added to the disclosures in proposed for Section 609(d)(2) 
by Section 3 of S. 1370 and to H.R. 2622. 
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from the agency and one model from each third party that develops models for 
broad-hased credit scores widely distributed by the agency, 

The above suggestions to improve existing proposals add to the choice and edu- 
cation available to consumers without placing a significant, additional burden on ei- 
ther the credit reporting agencies or score developers. Nothing forces a third-party 
developer to make its score available. If the third party refuses to authorize disclo- 
sure at a reasonable fee, the agency has no obligation to offer the score. The number 
of different scores the agency must offer is limited because an agency must offer a 
score only if the score is a broad-based credit score that the agency widely distrib- 
utes to lenders, and then only one score from each such third-party developer. More- 
over, the legislation is flexible and will adapt as the credit scores used by lenders 
change. As a particular score becomes more widely distributed to lenders, it will be 
more useful to consumers and therefore it will be requested more often. When a new 
score becomes the broad-based credit score most widely distributed to lenders by 
that credit reporting agency, the score provided to consumers who do not exercise 
a choice will change to the score that is most likely to be helpful to the consumer. 
Existing score disclosure proposals can and should be modified to give consumers 
more choice and to continue to improve consumer credit education. 

Credit Score Regulatory Overview 

I will say to you that it is very important to us to maintain a system which 
enables those models and those technologies to advance, because if they 
don’t we’re probably going to find that costs — interest costs and availability 
for credit to the average consumer are likely to rise. 

Alan Greenspan, testifying about credit scoring at the July 15, 2003, House 
Committee on Financial Services Hearing on Monetary Policy. 

We believe that Chairman Greenspan can comfortably make the above cautionary 
statement because existing regulation and oversight by various governmental agen- 
cies is working well. Credit scores are one of many methodologies used by lenders 
to make better lending decisions, and every lender is required by law to use those 
methodologies in compliance with applicable laws, including the Equal Credit Op- 
portunity Act. Regulation B, promulgated under the ECOA, prohibits lenders from 
using prohibited bases in the lending decision, such as race, marital status, religion, 
and national origin. Consumer reporting agencies do not collect that information, 
except what may be collected in accordance with identifying the consumer. That 
identifying information is not utilized in Fair Isaac’s scoring models. Consumer re- 
porting agencies collect data in five general categories. (1) Header information that 
identifies the consumer, such as name, address, date of birth. Social Security num- 
ber; (2) Trade lines (for account information); (3) Public records; (4) Collections; (5) 
Inquiries. Fair Isaac’s credit bureau scoring models do not utilize any of the header 
information in category 1. 

The OCC and other banking regulatory agencies have access to published Per- 
formance Charts for the Fair Isaac Credit Bureau Risk Scores. Fair Isaac periodi- 
cally produces those Performance Charts (also called Validation Odds Charts) from 
new national credit bureau data samples used for model update purposes. These 
charts demonstrate and prove that the FICO score rank-orders consumers according 
to repayment risk. 

Clients for whom Fair Isaac develops custom models are provided a suite of devel- 
opment statistics with each custom model development so the client may share that 
information with examiners. These statistics demonstrate the rank-ordering of pay- 
ment performance for the client’s specific portfolio based on their specific definition 
of “bad” payment performance. Fair Isaac also provides information on the indi- 
vidual characteristics that make up the client’s custom models. These statistics 
show the predictive content contained in each characteristic and illustrate why the 
scorecard contains the characteristic mix that it does. 

Fair Isaac also provides complete score tracking standards so that the client is 
able to monitor the performance of the model and scores, and track changes in the 
profile of their population over time. The OCC and other banking regulatory agen- 
cies have access to these performance statistics and tracking standards, as of course 
do the banks themselves. 

One way lenders are assured their use of Fair Isaac credit scores complies with 
existing regulations is the following warranty and representation found in Fair 
Isaac’s contracts with the credit reporting agencies and end-user lenders: 


These protections could easily be added to the Limitations proposed for Section 609(d)(1) 
in Section 3(b) of S. 1370 and to H.R. 2622. 



579 


Fair Isaac, the developer of [insert score name], warrants that the scoring 
algorithms used in the computation of the [insert score name] Score are em- 
pirically derived from [insert name of ] credit data and are a demonstrably 
and statistically sound method of rank-ordering candidate records with re- 
spect to credit risk, and that no scoring algorithm used by [insert score 
name] uses a “prohibited basis” as that term is defined in the Equal Credit 
Opportunity Act and Regulation B (Reg. B) promulgated thereunder. 

Regulatory agencies charged with overseeing the safety and soundness of lenders 
have a variety of regulations pertaining to credit scoring such as the OCC’s Bulletin 
97-24, dated May 20, 1997. (accessible at http:! lwww.occ.treas.gov I ftp I bulletin 1 97- 
24.txt ) 

Regulators are Well Trained to Oversee Lender’s Use of Credit Scoring 

Fair Isaac has actively partnered with many regulators for many years to help 
ensure there is informed and effective oversight of the use of credit scoring. 

Office of the Comptroller of Currency 

Right after the above OCC bulletin was issued in June 1997, Fair Isaac hosted 
three representatives of the OCC at an interactive scorecard engineering meeting 
at which scorecard engineering was demonstrated to help the OCC understand the 
methodolo^ used to develop credit scorecards. Fair Isaac has continued to work 
with the OCC since then, such as the 2-day seminar on April 10-11, 2002 in Dallas 
entitled, “Making the Most of Scoring Tools.” The seminar covered scoring concepts, 
model development, implementation issues, uses of scores in strategies across the 
account lifecycle, and tracking and validation. The seminar focused on both custom 
application risk models and Fair Isaac credit bureau risk scores, 

Federal Financial Institutions Examination Counsel 

On June 4, 2002, approximately 205 examiners from the Federal Reserve, OCC, 
OTS, FDIC, NCUA, and Farm Credit Administration attended a day-long seminar, 
“Making the Most of Scoring Tools,” covering scoring concepts, model development, 
implementation issues, and tracking and monitoring, and focused on custom applica- 
tion risk models and the Fair Isaac credit bureau risk scores.^^ 

Office of Thrift Supervision 

Fair Isaac has delivered a series of 2-day seminars for the OTS (November 2001, 
April 23-24, 2002, and October 15-16, 2002, April 22-23, 2003) focused on the Fair 
Isaac credit bureau risk scores and pooled application risk models. Fair Isaac is 
scheduled to deliver another seminar in 2003 and two, 2-day seminars in each of 
2004 and 2005 . 22 

Conclusion 

Fair Isaac is proud of its role in providing actionable credit score information to 
empower consumers to improve their financial literacy and is committed to con- 
tinuing its efforts in both the regulated and private disclosure of credit scoring infor- 
mation. I thank you for the opportunity to share with you Fair Isaac’s expertise and 
experience in this important area. 


PREPARED STATEMENT OF SCOTT HILDEBRAND 

Vice President, Direct Marketing Services 
Capital One Financial Corporation 
July 29, 2003 

Chairman Shelby, Ranking Member Sarbanes, and Members of the Committee. 
My name is Scott Hildebrand and I am appearing before you on behalf of Capital 
One Financial Corporation where I serve in the capacity as Vice President for Direct 


i^See Agendas, Attachment 7. 

20 The FFIEC was established in 1978 and consists of the Chairpersons of the FDIC and the 
National Credit Union Administration, the Comptroller of the Currency, the Director of the 
OTS, and a Governor of the Federal Reserve Board appointed hy the Board Chairman. The 
FFIEC’s purpose is to prescribe uniform Federal principles and standards for the examination 
of depository institutions, to promote coordination of bank supervision among the Federal agen- 
cies that regulate financial institutions, and to encourage better coordination of Federal and 
State regulatory activities. 

21 See Agendas, Attachment 7. 

22 See Agendas, Attachment 7. 
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Marketing Services. On behalf of Capital One, let me express my thanks to you for 
the leadership you have shown on this important issue. 

Capital One is one of the top 10 largest credit card issuers in the Nation, and 
a diversified financial services company with over 45.8 million customers and $60.7 
billion in managed loans outstanding. In addition to credit cards, we are one of the 
Nation’s premier auto finance companies, and also offer our customers an array of 
banking and related products. We employ nearly 18,000 associates worldwide, with 
offices around the country and overseas. 

We wish to commend you and the Congress on the work you have done to support 
financial education programs. Last year. President Bush signed into law the “No 
Child Left Behind Act of 2002,” making $385 million available to State educational 
agencies to encourage the sharing of best practices and the teaching of basic eco- 
nomic principles and personal finance. This Act put into place the resources that 
teachers need to teach basic personal finance and personal finance management 
skills to school-age children. We believe that this Act has served as a foundation 
for improving the Nation’s level of financial literacy as the monies have put more 
schools in the position of being able to incorporate personal finance teaching into 
their curriculum. 

Informed Customers are Key to Capital One’s Suceess 

At Capital One, we believe that a thorough understanding of financial matters not 
only helps consumers to make better decisions, but also helps to ensure the contin- 
ued health of the financial services industry. In the banking business, there exists 
an age-old truism: Anyone can lend money; success is measured by whether you are 
paid back. We are not successful if our customers fail to manage their personal fi- 
nances effectively, and thus are unable to meet their credit obligations. To borrow 
a phrase from legendary clothing retailer Sy Syms, “An educated consumer is our 
best customer.” Capital One’s success can be attributed to its offering the most at- 
tractive products and pricing in the market today, including the lowest fixed credit 
card rate in the Nation of 4.99 percent, and auto rates as low as 3.89 percent. It 
is our belief that consumers who understand the benefits of these products will 
choose Capital One. 

Continuous Financial Education is a Vital Component of Our Customer Interactions 

Capital One believes that clear communication about its products and services is 
important to maintaining successful relationships — ensuring better customer reten- 
tion in a highly competitive environment. Therefore, each product is accompanied 
by basic information that covers how our cardholders can avoid fees, stay within 
their established credit limit, obtain copies of credit bureau reports, and understand 
how their annual rates are applied. 

Our best channel and most direct vehicle for reaching our cardholders is their 
monthly statement. We include financial tips that are pertinent to their account in 
prominent locations on the statement where it is most likely to be noticed. We have 
used this vehicle to inform cardholders of their account status and to remind them 
to make payments, check their bureau reports, and to monitor their credit line. 
Some sample messages include: 

Why does good credit count? Employers check credit references before hiring 
new people. Banks and leasing companies often base the interest rate they 
offer you on your credit rating. Achieving life goals such as buying a new 
car or owning your own home are facilitated by good credit. Credit bureaus 
keep information on your record for up to 10 years so a credit problem his- 
tory can follow you around for a long time. 

Overlook your bill? Be sure to make your payment today. 

First-Time Cardholders Receive a Course on “The Fundamentals” 

Understanding that Capital One may be the first credit card for many college-age 
cardholders, we have built financial education into all product touchpoints. Upon ac- 
tivation of the card, college students receive a welcome booklet that explains the ins 
and outs of credit. Our message focuses upon the importance of building a positive 
credit history — making at least the minimum monthly payment by the due date 
each month, and making sure to always stay within the credit line. 

Following the welcome package, for their first year with Capital One, cardholders 
will receive quarterly reminders about the importance of maintaining good credit 
habits. Created with Myvesta.org and the Jump$tart Coalition for Personal Finance 
(Jump$tart), these reminders provide more detailed information on being cost con- 
scious, understanding how interest and finance charges can add up, the cost of ac- 
cessing cash advances, warning signs of having too much debt, obtaining a copy of 
credit bureau reports, and the importance of saving. 
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Capital One has also joined forces with YOUNG MONEY, the leading quarterly 
money and lifestyle magazine for young adults, to provide information to our card- 
holders on improving their financial decisionmaking skills. In this first-time ven- 
ture, Capital One and YOUNG MONEY will co-brand a website specifically geared 
to our cardholders. In addition, we will provide a free 1 year subscription to a select 
number of our college age cardholders. Because YOUNG MONEY’S articles are writ- 
ten by college students for college students, the magazine’s content addresses the 
financial concerns specific to this age group. YOUNG MONEY covers a variety of 
money related matters including: 

Money Management — Find the best ways to control your budget and pay off 
debt. Learn how to save money and cut your expenses. 

Investing — Ever wanted to invest in the stock market? Find out everything that 
you need to know before you invest your money. 

Financial Aid — Learn the best ways to finance your education. Get tips on find- 
ing and winning scholarships, applying for student loans, and more. 

Credit and Debt — Manage debt the smart way — check out tips about credit 
cards, debt control, and credit reports. 

Careers — Find career-building resources, and read about successful job searches, 
interviews, and resumes. 

Consumer Issues — Learn to be a smart consumer by spotting credit-repair 
scams, Internet service rip-offs, and fraudulent business “opportunities.” 

Our basic website for young adult cardholders has a range of education topics and 
includes a listing of frequently asked questions that covers maintaining good credit, 
avoiding fees, dealing with creditors, and the difference in variable and fixed rates. 
There is also contact information for all three major credit bureaus so customers can 
track the progress their making in building good credit. Upon instances when our 
young adult cardholders miss a payment or go over their credit limit, we will for- 
ward them a warning e-mail that outlines the importance of paying on time and/ 
or staying below their limit. 

Information Is Available to All Consumers Online 

We have also placed a “Financial Tool Box” on Capital One’s website, which in- 
cludes guides, articles, and calculators that give consumers a better understanding 
of how to use our products. Articles include: 

How Credit Works and Your Credit Rights — ^As a current cardholder, you no 
doubt have a firm grasp on how credit works. However, your card comes with sev- 
eral important, built-in legal benefits you may not be aware of The law protects 
many of these “credit rights.” 

Your Credit History — ^Your credit report does more than track your credit and 
how you pay your bills. It represents your financial profile, and it can affect more 
than just your ability to obtain additional credit. 

Managing Credit and Key Strategies for Money Management — The key to 
managing your credit is control — control of how much you spend on credit, how 
quickly you pay it back, and the types of items you purchase. Credit is not a finan- 
cial cure-all. Used the right way, however, it can help you afford certain purchases 
and build a powerful credit rating. 

Safeguarding Credit and Learning how to Protect Your Credit from 
Thieves — We provide a number of tips for consumers to avoid identity theft and 
provide them with the steps they will need to take if they should ever become a 
victim. 

Our customers also have access to their accounts online where they can view re- 
cent transactions and available credit, see pajunent due dates to help avoid late pen- 
alty fees and update account information. 

Capital One Seeks to be Part of the Solution on Financial Education 

Our efforts to improve financial literacy are not limited to our existing customers. 
Capital One has invested considerable time, effort, and money to develop innovative 
and far-reaching programs to improve financial education. 

Capital One’s Financial Education Activities Have Been Designed With a Focus 
on Effectiveness and Impact 

Capital One’s business success has been driven largely by a highly analytical “test 
and learn” culture that seeks to customize products and services to the specific 
needs of individual consumers. Our founders realized that a “one-size-fits-all ap- 
proach” makes little sense in an environment where each consumer possesses vastly 
different needs and characteristics. This “test and learn” culture pervades every- 
thing we do, from designing our products to meeting the needs of our associates. 
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Not surprisingly, it also influences profoundly how we have chosen to tackle the im- 
portant issue of financial education. 

Several years ago, we undertook a major corporate initiative to develop a financial 
education program. Following the Capital One method of doing business, we started 
by surveying the market to assess the delivery and methodology used by existing 
financial education programs. Our research revealed a high level of activity using 
a wide variety of approaches. While looking for information regarding best practices, 
we found limited understanding of what types of programs were most effective for 
which populations. We read training materials that were attractive visually, but we 
wondered if the language used was too complicated to reach the target populations. 
We also found quality materials without an effective method for getting the mate- 
rials to market. Finally, we observed a limited amount of measurement and evalua- 
tion in the programs to assess their effectiveness. 

As a result of our research, we initially decided to focus on those most in need — 
lower-income and underbanked populations. We spent time thinking about two key 
goals: First, how to develop content that would be read and understood; and second, 
how to develop a delivery method that would effectively reach our targeted popu- 
lations. As a result, we decided the best approach would be to find a strong non- 
profit organization with whom we could partner — an organization that would bring 
expertise in materials development and have existing relationships with community- 
based organizations who are best situated to reach underserved communities. 

Capital One Has Formed a Partnership With Consumer Action 

Following the research and development of our program goals, we contacted Con- 
sumer Action (CA) to discuss the feasibility of developing a partnership related to 
financial education for lower-income communities. Founded in 1971, CA has a long 
history and strong record of work in this area. Because CA is an umbrella organiza- 
tion whose membership includes more than 7,000 community-based nonprofit orga- 
nizations throughout the country, we were confident that delivery of the materials 
to reach our target consumers could be achieved. 

Since beginning our partnership, we have developed a highly effective collabora- 
tion that has produced measurable results. Capital One has donated approximately 
$1.25 million to create and implement MoneyWi$e, a program that offers straight- 
forward, easy-to-read information to address financial responsibility. Together, we 
have created a four-part series of MoneyWi$e educational materials that provide the 
building blocks for developing and honing personal finance skills. These four bro- 
chures focus on key financial education issues, including: 

Building Good Credit — Explains what credit history is, what a credit report is, 
how to get your credit report, how to establish good credit, and where to complain 
if you have a problem. 

Credit Repair — Explains why having good credit is important, your rights if 
your credit application is rejected, how to check your credit report, how to dispute 
mistakes on your credit report, and how to begin to rebuild good credit. 

Basie Banking — Discusses the fundamentals of banking, from opening a bank 
account to balancing a checkbook, and includes tips for resolving problems such as 
mixed up deposits and bounced checks. 

Basie Budgeting — Explains the importance of wise money management, includ- 
ing budgeting, balancing your checkbook, cutting back on expenses, and ways to 
spend less and save more. 

Capital One’s financial support of this program ensures that these materials are 
provided to nonprofit organizations and consumers free-of-charge. In addition, we 
feel it is critical that they be offered in multiple languages to ensure that we reach 
immigrant groups, many of which have had negative experiences with banks in 
their home countries and are vulnerable to unscrupulous financial service providers. 
The materials are available in four languages in addition to English including Span- 
ish, Chinese, Korean, and Vietnamese. Through CA, materials are available to their 
membership of their more than 7,000 community organizations nationwide, as well 
as directly to consumers via mail or the Internet. I am proud to report to date the 
distribution of these multilingual materials totals more than 1 million brochures. 

Our plans for later this year include creating and distributing information on two 
additional topics: The first is a guide for parents on talking to teens about money 
and the second is about understanding bankruptcy. 

Capital One and CA also joined forces to develop a “train-the-trainer” program for 
community-based organizations. We liked this approach because it enabled us to le- 
verage the talents of other organizations to achieve a higher impact at the local 
level. Together with CA, we were able to develop curricula that focus on the key 
issues contained in the brochures. The results have been phenomenal. To date, more 
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than 800 nonprofit organizations across the country have requested the information. 
They have included a wide variety of types of organizations such as university coop- 
erative extension offices, consumer credit counseling service organizations, and com- 
munity development corporations. 

During the fall of 2002, Capital One and CA co-sponsored Statewide meetings in 
Tampa, Florida and Oakland, California to train the leaders of nearly 75 commu- 
nity-based organizations in each location to use the MoneyWi$e materials in their 
communities. The 2-day meetings included sessions to review the materials and 
train participants on teaching adult populations. They were interactive and included 
many hands-on activities designed to reflect real-life situations. A follow-up survey 
on the training sessions found a high satisfaction level among participants. We have 
two additional meetings planned for later this year; one meeting will take place in 
Dallas and serve agencies throughout Texas and the other will take place in the 
District of Columbia and serve agencies in the metropolitan area. 

We have also strengthened the program by offering stipends to 18 nonprofit orga- 
nizations around the country that are starting to teach financial education to their 
constituents — the grants provide them with the funding they need to staff and pro- 
vide additional resources. We anticipate reaching approximately 60,000 consumers 
through the reach of the program. 

This month, the MoneyWi$e partnership received the Achievement in Consumer 
Education award by the National Association of Consumer Agency Administrators. 

We Have Engaged the Talent of our Employees To Deliver Financial Education to 
our Local Communities 

Capital One believes in the value of employee involvement in community service. 
We have a long-standing focus on company-sponsored volunteerism in the areas of 
youth-at-risk, education and community development. Therefore, it made sense to 
incorporate financial education into our volunteer activities as we were developing 
our program. 

Trained by CA and equipped with materials and a training/curriculum manual. 
Capital One employees pilot-tested this approach in its home communities of Rich- 
mond and Northern Virginia. Our volunteers have contributed approximately 250 
hours to teach the information to constituents of several nonprofit organizations. Be- 
cause of the overwhelmingly positive response from employees, the program is being 
expanded to other Capital One sites around the country. 

Capital One Focuses on Youth Through Its Partnership With Jump$tart 

Five years ago, to align our financial education program with our philanthropic 
focus on helping youth-at-risk, we joined Jump$tart. The premise behind our 
support of this program is simple: We believe in their mission to teach financial edu- 
cation in the public schools. And the most effective method for reaching a wide pop- 
ulation, including lower-income children, is through a public education program. 

Based on this belief, we provided financial support for the integration of 
Jump$tart’s Money Math curriculum into the Virginia school standards. Through 
this effort, we hoped to provide another tool that Virginia teachers can use to teach 
their students about personal financial management. At a press conference last 
Spring, the U.S. Department of the Treasury’s Office of Financial Education recog- 
nized Capital One for this effort. 

Targeting and Reaching College Students 

There has been a tremendous amount of concern expressed about college students 
and the need for financial education. Capital One shares this concern and has devel- 
oped a unique method to reach this population. Specifically, we decided to experi- 
ment with a method that utilizes students’ relationships with their peers. Last year, 
we piloted MoneyWi$e for College Students, a “train-the-trainer” program that 
teaches college students how to become “money mentors” and deliver personal fi- 
nance curricula to other students at their colleges or universities. 

MoneyWi$e for College Students is a program whereby student leaders use their 
influence to educate fellow students about how to make informed credit decisions. 
Currently, the program is delivered on three college campuses including the Univer- 
sity of South Florida, Texas A&M University, and Washington State University. Be- 
cause of the success of this test, we are currently in talks to expand the program 
to additional universities this coming fall — we have received interest from the Uni- 
versity of Maryland, Pennsylvania State University, and the University of Alabama. 

The workshops cover a broad range of topics from how to maintain a checking 
account to understanding credit reports. In addition, students attending the work- 
shops receive informational brochures focusing on basic money management. Cap- 
ital One sets up a page on the website of participating universities that links to 
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Visa’s Practical Money Skills. The training program results reported by partici- 
pating students has been impressive: 

• 100 percent would recommend the program to other students. 

• 100 percent reported that the program improved their understanding of basic 
money management concepts. 

• 84 percent indicated that the program taught skills and concepts that were new 
to them. 

• 95 percent rated their impression of Capital One and Visa as “very or somewhat 
positive.” 

We Encourage the Media To Report on Financial Topics To Help Educate the Public 
Capital One has sought to utilize the media to provide the public with tools to 
better manage their finances. All of our fact sheets are available on our website’s 
press center, and serve to encourage reporters to write stories on these topics. Ear- 
lier this summer, we ran an auto buying campaign that advised consumers to pre- 
pare carefully before buying this big-ticket item. This campaign made 26.8 million 
impressions and was covered by print, television, and radio reporters. 

Other campaign efforts have focused on key life events: (1) The back-to-school 
shopping ritual and importance of parents explaining to their kids how to budget; 
(2) what newlyweds need to be aware of when they first tie the knot; (3) budgeting 
for the holidays; and (4) staying fiscally fit, in general. 

Financial Services Industry Continues To Increase Its Focus on Financial Education 
Thankfully, we are not alone in our efforts. According to the Consumer Bankers 
Association (CBA) annual survey on financial literacy, the number of financial insti- 
tutions sponsoring or partnering on financial education initiatives continues to in- 
crease year after year. Not surprisingly, these programs have focused on the most 
vulnerable segment of consumers. 

Youth 

The CBA survey confirmed that there is a strong effort among banks to advance 
personal finance skills among youth. Seventy-seven percent of responding banks 
indicated that they offer financial literacy programs for students in grades K-12, 
organizations like Jump$tart, the national “Adopt-a-School” program, and employ- 
ees/student mentoring. At the post-secondary level, 26 percent of financial institu- 
tions offer financial education programs on college campuses. 

The Unbanked 

For the first time, CBA polled banks on their efforts to address the financial serv- 
ices needs of the unbanked. Seventy-four percent of responding institutions 
indicated that they offer Individual Development Accounts to such consumers. Fifty- 
seven percent of responding banks indicated that they have developed a personal 
finance program or initiative specifically designed for unbanked consumers. 

Recent Immigrants and Multilingual Consumers 

In addressing the particular needs of a major segment of the unbanked popu- 
lation — immigrants and non-English speaking consumers — 70 percent of responding 
banks indicated that their institution provides financial education programs, basic 
banking literature, or educational brochures in a foreign language, primarily Span- 
ish. Particular attention is being paid to small business development, which has 
shown a significant upward trend in the percentage of banks offering such pro- 
grams. This year, 79 percent of responding banks indicated that they sponsor or 
partner on programs aimed at providing small business development assistance. 

Conclusion 

At Capital One, we believe in the principle that knowledge is power. It is that 
power that will enable the American consumer to make better choices about their 
personal finances. 

Our products work best if our customers manage their finances responsibly. Put 
another way, the less our customers know, the more likely they are to find them- 
selves in financial trouble. When these customers cannot pay their bills, we bear 
the loss. Higher losses in turn, leads to higher costs for everyone. For Capital One, 
“educated consumers” — customers who know the annual percentage rate they are 
paying, who know when their bills are due, and who know and understand how to 
manager the products we offer — are our best customers. 

Mr. Chairman, Ranking Member Sarbanes, and Members of the Committee, 
thank you again for the opportunity to testify before you. I would be happy to an- 
swer any questions you may have. 
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RESPONSE TO WRITTEN QUESTION OF SENATOR SARBANES 
FROM DOLORES S. SMITH 

Q.l. I have introduced S. 1470, the Financial Literacy and Edu- 
cation Coordinating Act. What are your views on this legislation? 
A.l. The development and adoption of a national strategy for im- 
proving financial education and knowledge in this country is a sig- 
nificant public policy undertaking, and the proposal for a Financial 
Literacy and Education Coordinating Committee merits strong sup- 
port. A committee of decisionmakers from across the spectrum of 
Federal agencies will bring high-level visibility to the Government’s 
promotion of financial education and knowledge for all Americans. 
Drawing State and local agencies, along with private-sector organi- 
zations from industry and the nonprofit world, into the collabo- 
rative-consultative process adds an important dimension to the 
undertaking. 

While collaboration among agencies already takes place, having 
a formal mechanism for the development and coordination of a Fed- 
eral strategy would strengthen the process in a number of ways. 
It would facilitate the sharing among agencies and others of infor- 
mation on financial education activities; promote interest in and 
support of needed research for testing the effectiveness of different 
approaches to personal financial education; and foster increased en- 
gagement in financial education initiatives. Coordination through 
the Committee also could help minimize duplicative efforts at all 
levels, and assist in directing agency resources to where they are 
most needed or where they can be most productive. 




ADDRESSING MEASURES 
TO ENHANCE THE OPERATION OF 
THE FAIR CREDIT REPORTING ACT 


THURSDAY, JULY 31, 2003 

U.S. Senate, 

Committee on Banking, Housing, and Urban Affairs, 

Washington, DC. 


The Committee met at 10:20 a.m., in room SD-538, Dirksen Sen- 
ate Office Building, Senator Richard C. Shelby (Chairman of the 
Committee) presiding. 

OPENING STATEMENT OF CHAIRMAN RICHARD C. SHELBY 

Chairman Shelby. The hearing will come to order. 

Secretary Snow, good morning and welcome to the Committee. 
We appreciate you coming here today to express the Administra- 
tion’s views on this important subject. 

Today, the Committee comes to the final in a series of hearings 
that we have held on the Fair Credit Reporting Act. 

We adopted this, process because the FCRA, the Fair Credit Re- 
porting Act, is a complex statute that regulates a complicated and 
dynamic component of the marketplace that is crucial to the oper- 
ation of our economy. 

It is my hope that we have met our responsibility of conducting 
a comprehensive review. In the near future, we will begin devel- 
oping le^slation to address the matters identified as issues during 
our hearing process. 

Drawing upon what we have learned from our many witnesses, 
we will approach this task with the perspective that while the sys- 
tem is generally pretty good, I think it can and must get better. 

I believe we have identified real questions about the level of ac- 
curacy in credit reporting. There are numerous issues associated 
with the insidious crime of identity theft. There are areas where 
consumers need more opportunities to make their own choices and 
greater information to make informed decisions. Last and perhaps 
most importantly, we are faced with the question of how best to en- 
sure that with constantly evolving credit markets, the maximum 
fairness, accuracy, and efficiency is consistently achieved. 

To help move toward solutions, today’s witnesses are here to pro- 
vide their views regarding these and other issues. I think there is 
much for the Committee to gain from their input. 

In our first hearing, I expressed the view that it should be our 
goal to ensure that the Fair Credit Reporting Act produces the 
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most effective, efficient, balanced, and fair system achievable. As 
we close the hearing process, I remain hopeful that we can meet 
this goal. 

Again, I want to thank Secretary Snow, Secretary of the Treas- 
ury, for being here, and I look forward to yours and other wit- 
nesses’ testimony. 

Secretap^ Snow, your written statement will be made part of the 
record in its entirety. You proceed as you wish. 

STATEMENT OF JOHN W. SNOW 
SECRETARY, U.S. DEPARTMENT OF THE TREASURY 

Secretary Snow. Thank you very much, Mr. Chairman, and 
Members of the Committee. It is a pleasure to be here with you 
today to talk about a subject that is critically important to the way 
our credit markets and financial institutions work in the United 
States. 

We have submitted a proposal to strengthen the use of the Fair 
Credit Reporting Act in a way that I think promotes consumer in- 
terest and continues to make access to credit and other financial 
services available at a low cost, and to Americans who are seeking 
credit. 

It is important to understand that these uniform national stand- 
ards for information sharing operate in a very fundamental way to 
expand the opportunity for consumers to get access to credit and 
to a broad range of financial services. 

What they really do is allow you to take your reputation with 
you as you travel around the country. America is a very mobile so- 
ciety. Something like one-sixth of the American families move in a 
given year. As you move, you leave the place where you are known, 
you move to another State, another city, you can get credit. You 
can buy a house. You can buy an automobile. You can go into a 
store and easily get credit because your reputation follows you 
around and you do not have to start from scratch, and that is criti- 
cally important in a mobile society like the one we have in the 
United States. 

These national uniform standards really play a critical role in 
making the miracle of modern credit available. From 1995 to 2001, 
the percentage of minority families — and I think it is important to 
recognize the impact they have on minorities and people at the 
lower-income levels — holding mortgages increased significantly. 
One-sixth of minorities who qualified for mortgages in 2001 would 
not have qualified, would not have qualified in 1995, and we see 
a higher rate of improvement in homeownership among minorities 
than we do for the overall percentages. Similarly, the percentage 
of minority families with credit cards has risen very, very substan- 
tially and disproportionately to the population as a whole. That is 
a credit to what these uniform standards make possible. 

But there are problems in this world of credit, and the most seri- 
ous worry for financial consumers today is, as you all know, iden- 
tity theft. A recent private study reports that identify theft has 
been greatly under reported, and according to this study, as many 
as 7 million Americans were victims of identity theft last year. Of 
course, once you lose your identity, many enormously bad things 
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happen to you and it is very difficult to get your good identity back, 
and you are put through a hellish period. 

Many identity thieves specifically target the most vulnerable 
members of society: That is, families of the recently deceased, hos- 
pital patients, men and women serving in the U.S. armed forces 
that are away from home. Our national information sharing sys- 
tem, made possible by the Fair Credit Reporting Act, is an impor- 
tant tool in this fight against identity theft, and it can be made 
even more effective. 

With the right information about your true identity, financial in- 
stitutions can ask the validating questions that can unmask the 
identity theft and the identity thieves. In other words, the banker, 
our bankers and your bankers, can stop the identity thief if that 
banker or that financial institution knows more about you than the 
thief does. That is part of what we are trying to do with our rec- 
ommendations, is to put the banks in that position. 

National uniform standards make timely access to full and accu- 
rate information possible, giving the financial institutions the tools 
to stop many identity theft assaults before they can succeed. In 
other words, seeing the information moving faster than the thieves 
can move, and getting ahead of the thieves. 

On June 30 this year, I announced the Administration’s proposal 
to remove the sunsets on the uniform standards, and focus these 
standards, and the FCRA itself, even more effectively on meeting 
two key consumer interests, the interest in improved access to 
credit and financial services and the interest — and I know this is 
important to every one of you on the Committee — the interest in 
the accuracy and the security of financial information. 

Let me just quickly go through a few highlights of our proposal. 
First, we would recommend making free credit reports available 
upon request. They are of course available today under certain cir- 
cumstances, but we think that an annual free credit report from 
the credit reporting agencies is appropriate. A basic tool to place 
in the hands of the consumers is access to their credit reports. As 
I say, once a year upon request, free of charge, doing so we think 
would enhance the accuracy and the completeness of the credit re- 
ports. We think the credit reporting agencies have an interest in 
engaging the users, the consumers, to make sure that those reports 
are accurate. Making these free reports available annually upon re- 
quest will do just that because then the consumers can correct 
those reports if they see an error in them. 

Second, we would propose a system of national security alerts. 
Under this system, uniform standards would include allowing con- 
sumer who have been victimized or who are in danger of being vic- 
timized, to put banks and merchants on guard against the efforts 
of those who may be trying to impersonate them. 

Third, we would propose a system of red flags. This is a related 
effort in which we suggest bank regulators should watch for pat- 
terns followed by identity thieves, and put in place red flags that 
indicate the likelihood of fraudulent activity, and share this infor- 
mation with each other so that the whole group of financial regu- 
lators are part of the effort to share information, put up red flags 
and make it tougher for identity theft to occur. Under our proposal, 
the regulators would provide notices of these red flags to the insti- 
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tutions that they supervise, and would verify in their bank exami- 
nations that these warning signs are being heeded, and that the 
banks are really following the red flag indicators, and they will be 
empowered to fine those institutions where there is lack of appro- 
priate attention to the red flags. 

Finally, fourth, because we have other suggestions, and I am just 
giving you the highlights here, we would propose a prohibition on 
the sale or transfer of identity theft debt: That is, once an institu- 
tion has been notified that there is a threat of an identity theft, 
that institution would be precluded from going off and selling that 
debt. So, we would propose prohibiting the sale or transfer of debt 
for collection that a creditor knows is the result of identify theft. 
This measure would help reduce the repollution, if you want to use 
a word, of consumers’ credit files with wrong information, and save 
consumers countless hours of needless hassle in trying to restore 
their good name. 

We look forward to working, Mr. Chairman, with you. Ranking 
Member Sarbanes, and all of the Members of the Committee, to en- 
sure that the Fair Credit Reporting Act becomes an even more ef- 
fective tool to meet the financial interests of America’s consumers. 

Thank you very much for the chance to be here today. 

Chairman Shelby. Thank you. Secretary Snow. 

Mr. Secretary, during the course of the Committee’s review of the 
Fair Credit Reporting Act, the Banking staff asked the General Ac- 
counting Office to perform an analysis of the accuracy of credit re- 
ports. The GAO has just come back with these results, which will 
be included in the record here today. 

The chief finding of the report by the General Accounting Office 
was that only limited and to some degree contradictory information 
was available with respect to the overall accuracy of credit reports. 
Specifically, GAO concluded, “Information on the frequency, type, 
and cause of credit report errors is limited to the point that a com- 
prehensive assessment of overall credit report accuracy using cur- 
rently available information is not possible.” 

This is troubling, concerns us. In order for us to know where 
things stand presently, and to know the direction that the new Fair 
Credit Reporting Act provisions would take things in the future, in- 
cluding measures such as one you have outlined, Mr. Secretary, we 
need some independent data to make informed determinations. 
Considering the importance of credit reports to the credit process, 
Mr. Secretary, is it not worth the effort to get an objective under- 
standing as to how accurate the reports are? 

Secretary Snow. Absolutely, Mr. Chairman. I agree with you. It 
is important, though, I think to distinguish what features of the re- 
port are inaccurate. 

Chairman Shelby. Absolutely. 

Secretary Snow. Understand I am not an expert on this, but 
there are people at the Treasury that I have talked to who are, like 
Mr. Abernathy, who indicate that some of this information is fairly 
trivial and some of it is not. 

Chairman Shelby. What is substantive and what is trivial? But 
a lot of times it is substantive, and really accuracy goes to the 
heart of the report, does it not? 



591 


Secretary Snow. I think having better understanding of this 
whole question is very important. I think the credit agencies them- 
selves have a real stake in having better information, and in cre- 
ating greater trust in the accuracy of the information. I share your 
concern about this. 

Chairman Shelby. Mr. Secretary, the Administration, which you 
are part of as Secretary of the Treasury, has recommended perma- 
nent extension of the preemption provisions. In some of our discus- 
sions with stakeholders involved with issues related to the Fair 
Credit Reporting Act, we have been told that many, if not most, of 
the positive developments they have seen have come just in recent 
months as we have been holding these hearings, when the shadow 
of reauthorization loomed largest. I guess this is common sense. 

Do you think, Mr. Secretary, that at a minimum, the process of 
reauthorization tends to serve as a force that motivates interested 
parties to perform at a higher level, both here and in the market- 
place? 

Secretary Snow. I think being subject to scrutiny certainly 
heightens one’s attention and serves a useful purpose. 

Chairman Shelby. Absolutely. Is it worth noting, Mr. Secretary, 
that even at the time when the Fair Credit Reporting Act reauthor- 
ization is being considered, when you would think that everyone 
associated would be on their absolute best behavior, whatever that 
is, the FTC just completed an enforcement action and levied a sig- 
nificant fine against one of the big credit bureaus for failing to 
meet basic responsibilities with respect to handling consumer com- 
plaints. 

With that in mind, will the necessary incentives remain if reau- 
thorization is permanently taken off the table, or should we make 
sure that we provide some type of legislation to keep people on 
their toes? 

Secretary Snow. I think what we are trying to do in our proposal 
is create the right incentives for the whole system, that whole com- 
plex system of furnishers, scorers, and the credit reporting agen- 
cies, and the consumers themselves, to work in a more effective 
way, to create incentives for the whole system to work more effec- 
tively. We strongly support removing the sunsets, but recognize in 
removing the sunsets that Congress will continuously review, as 
you are doing today on how the system is working, and whether 
it is working well to protect consumer interest, and whether it is 
working well to make credit available at low interest rates. 

I think you have ample authority here and ample ability to con- 
tinue to police the system and create yourselves, through that over- 
sight, the right incentives. 

Chairman Shelby. Mr. Secretary, lastly, we heard testimony 
here that consumers are not all that well versed in the area of 
credit reporting, and I think the proposal to allow — that you just 
mentioned — free access to their credit reports will certainly help 
improve things. I also think it is almost as important here to make 
people aware of their right to a free report as it is to provide them 
the right in the first place. In other words, if you give them the 
right — ^you have talked about free reports — ^but they have to be 
aware of that right, which I think would really help in identity 
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theft, would help clear up misunderstandings and probably have a 
lot of positive things in it. Do you disagree with that? 

Secretary Snow. No. I agree very much. At the Treasury, we are 
engaged in this important effort on financial education which I 
think is central to 

Chairman Shelby. If they have a right, they need to know they 
have that right. 

Secretary Snow. Exactly. I think broader understanding of the fi- 
nancial system and people’s rights under it, is important, I agree. 

Chairman Shelby. Senator Sarbanes. 

COMMENTS OF SENATOR PAUL S. SARBANES 

Senator Sarbanes. Thank you very much, Mr. Chairman. 

Mr. Secretary, we are pleased to have you here before the Com- 
mittee. I am going to take advantage of the fact that you are here 
to digress for just a moment. 

I was following this bus tour that you and Secretary Chao and 
Secretary Evans were making out there in the Midwest, running 
around the countryside, and I noticed you indicated that you 
thought the Chinese Government needed to allow its currency to 
strengthen by widening its trading ban against the dollar. We have 
followed this issue of currency manipulation closely in this Com- 
mittee, and I welcome that statement on your part, but I want to 
underscore just how important I think it is. In fact, when we en- 
acted the Omnibus Trade and Competitiveness Act in 1988, it re- 
quests the Treasury — this has now been in existence some 15 
years — requires the Treasury to submit a report to Congress on 
international economic and exchange rate policy by October 15 of 
each year. The Act requires the Secretary of the Treasury, “to ana- 
lyze on an annual basis the exchange rate policies of foreign coun- 
tries and consider whether countries manipulate the rate of ex- 
change between their currency and the U.S. dollar for purposes of 
preventing effective balance of payments adjustments, or for pur- 
poses of gaining unfair competitive advantage in international 
trade.” 

I just have some process questions. One, do you anticipate sub- 
mitting that report on time, by mid-October? 

Secretary Snow. Yes, we do. Senator. 

Senator Sarbanes. And will the report contain the required anal- 
ysis of exchange rate manipulation? 

Secretary Snow. Yes, it will. 

Senator Sarbanes. The Act requires the Treasury Secretary to 
testify before Congress on the report if requested, and I think 
Chairman Shelby has indicated his desire to have such testimony, 
so presumably you would anticipate testifying before the Com- 
mittee on the report? 

Secretary Snow. Yes, indeed. 

Chairman Shelby. Senator, would you yield for a second on that 
same thing? We had Secretary Snow coming earlier in July, but he 
was traveling with the President, as I understood, so we postponed 
this hearing, did not cancel it, and added it to the October hearing 
schedule. I understand that the Treasury will be releasing the next 
exchange report in October, and that Secretary Snow then would 



593 


address these issues when he appears before the Banking Com- 
mittee at that time. Is that right? 

Secretary Snow. That is absolutely right, Mr. Chairman. 

Senator Sarbanes. I just wanted to indicate a number of us are 
looking forward to that hearing. We think it is an extremely impor- 
tant one in terms of international economics, and we are loolong 
forward of course to the report and the analysis, which the Treas- 
ury people will be making, of this possibility of seeking unfair com- 
petitive advantage in international trade by manipulating the cur- 
rency exchange rates. 

Mr. Chairman, I was not here right at the outset, but I wanted 
to take a moment to commend you for holding this series of hear- 
ings on the Fair Credit Reporting Act. I think each and every one 
of the hearings has been extremely productive, and I particularly 
commend the comprehensive approach you have taken in exam- 
ining these issues, and also the wide cross-section of interests that 
have been represented by the witnesses you have invited to the 
hearing table. I think it has given us some valuable insights into 
the workings of the Act as we consider solutions to the various 
issues that have been raised. 

As I noted at the outset, when we started, the Fair Credit Re- 
porting Act, really at its core is a consumer protection statute. I 
think it serves a very fundamental purpose helping to ensure the 
privacy of consumer financial data, the accuracy of credit report in- 
formation, and fair practices in the collection and the use of credit 
information and then credit granting. It is very important to lit- 
erally tens of millions of Americans that we work to ensure fair, 
accurate, and effective credit reporting practices as we consider re- 
authorizing the preemption provisions of the Act. 

Mr. Secretary, during these hearings we have received a number 
of recommendations for improving the operation of the Act. These 
suggestions have included — and I am going to go through a list of 
the summary headings, I guess. Beneath the summary headings 
there is obviously important questions of what are the details? The 
devil is always in the details, and I recognize that, and I am not 
going to, at this moment, get down to that level. But as I go 
through these summary headings, I just want to get some sense if 
there are any of them that you think are not an appropriate item 
for us to be looking at as we consider this reauthorization. Combat- 
ting fraud and identify theft; clearly, you have made that a lead 
item in your own statement. 

Secretary Snow. Yes, I have. 

Senator Sarbanes. Protecting consumers’ financial privacy. 

Secretary Snow. Certainly protecting the accuracy, security, and 
that translates into privacy information, is very important, yes. 

Senator Sarbanes. Clarifying the credit scoring process and the 
use of credit scores. 

Secretary Snow. Yes, we have recommendations in that area as 
well. 

Senator Sarbanes. Improving the accuracy of credit reports, 
which of course relates to the one I just asked. 

Secretary Snow. We have recommendations there as well, yes. 

Senator Sarbanes. Improving consumers’ understanding of the 
credit reporting process. 
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Secretary Snow. Very much so, as I responded to the Chairman 
earlier, yes. 

Senator Sarbanes. Combatting abusive marketing practices. 

Secretary Snow. Yes. Our proposal deals with that as well. 

Senator Sarbanes. Finding ways to improve the financial lit- 
eracy and education of all consumers. 

Secretary Snow. Yes, certainly. 

Senator Sarbanes. You have an office in the Department of the 
Treasury addressed to financial literacy and education. We have in- 
troduced legislation to set up a coordinating committee within the 
Executive Branch of the Federal Government to be headed actually 
by the Secretary of the Treasury, and to be staffed in effect by this 
office in your department. We had a number of agencies here the 
other day, all of whom work on consumer literacy and consumer 
education. As you know, from the Trade Promotion Coordinating 
Committee, we did a comparable thing in that area. I do not know 
whether you have had a chance yet to fully review that legislation. 

Secretary Snow. Senator, we support the broad thrust of what 
you and the Chairman are putting on the table here. There is an 
office that reports to Assistant Secretary Abernathy that deals with 
this broad question of financial literacy. We want to see that office 
become even more effective, even stronger in its capacity to deal 
with this issue. It is a critically important issue. I agree with you. 

Senator Sarbanes. Thank you very much. 

Thank you, Mr. Chairman. 

Chairman Shelby. Senator Bennett. 

COMMENTS OF SENATOR ROBERT F. BENNETT 

Senator Bennett. Thank you, Mr. Chairman, and I echo Senator 
Sarbanes comment about the thoroughness and the wisdom of this 
series of hearings. My experience on the Banking Committee, I do 
not know of any legislation that has had a series of hearings that 
has been as comprehensive as this and had witnesses from across 
the spectrum the way this one has, and now we are culminating 
in the statement from the Secretary, and I applaud you for the 
methodology of putting this together. 

If I can pick up on what Senator Sarbanes was saying, I listened 
very carefully to the list of items on which he focused, and there 
were a few things that I would like to add to that list. I will not 
suggest that Senator Sarbanes overlooked them. I will just suggest 
that I focused on them. 

In your testimony, you outlined what has happened since the 
Fair Credit Reporting Act has been in place and the amount of 
credit that is available to people that presumably was not available 
before and how it has facilitated the extending of credit, particu- 
larly to groups that were left out of credit earlier. 

As I have said at one of our previous hearings, I remember when 
I was sitting where Senator Corzine is sitting now, as a very new 
member of this Committee, and there is hope. Senator, that it 
moves really fast to come around the horse shoe. 

[Laughter.] 

The main issue that we were discussing at the time was avail- 
ability of credit, particularly for minorities. And we were beating 
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people up who would come before the Committee for the fact that 
credit was not made available. 

Their defense was, well, many of these people are not good credit 
risks. Now, by virtue of information about them and their credit 
habits being made widely available, we have discovered that they 
are better credit risks than the institutions thought they were and 
that credit is now being made available. 

I raise that because part of the testimony we have had here has 
suggested that if we do not extend the Fair Credit Reporting Act 
in essentially the same form that it has been in during this period 
of success, we run the risk of having credit begin to dry up for cer- 
tain people; in other words, we protect in the name of consumer 
protection, information to the point that it is not available and 
credit extenders then say, well, I cannot take the risk because I do 
not have the information. 

I am particularly focusing on the preemption clause with respect 
to that, and I love your statement when you said this allows you 
to take your reputation with you when you move. We have had tes- 
timony before the Committee that indicates that the number of 
Americans who move every year is in the tens of millions, and this 
is one of the challenges of the credit reporting agencies to keep up 
with people. And many of the errors that are in their files are er- 
rors of wrong addresses, wrong employers, et cetera, because the 
information does not catch up with the fluidity of the American 
workforce. 

I have had the experience of moving from one State to another 
prior to the Fair Credit Reporting Act and discovering it was ex- 
tremely difficult to get a mortgage in the new State. Fortunately, 
my family was fairly well known in Utah. I had moved back to 
Utah after a period of 24 years away, and it took my father going 
down to the credit reporting agency or to the financial institution 
with whom I was dealing and laying down his credit as a guar- 
antee of mine, having just moved from California, in order for me 
to get a loan, and now I can take that reputation with me. 

Let me shift with that now to one quick question for you, and 
maybe we will get around to a second round on some other issues. 

Free credit reports on request. I back this. I think it is a very 
logical thing, but again let us get into the details. We are asking 
the credit reporting agencies to give away their product. That 
which they charge for, that which they earn their money on, we are 
saying you have to give this away. And as long as they are giving 
it away to a relatively small percentage of the people whose names 
are in their files, they can handle that. 

But as we drive toward getting them to give away their products 
to more, and more and more people, it raises all kinds of questions 
about who is going to pay for it eventually and will some enter- 
prising providers of credit say, look, you ask for your credit report 
and bring it in along with your application for a loan, so I will not 
have to ask for it, and therefore I do not have to pay for it. 

Have you given any thought as to what can be done to deal with 
the cost implications of saying to an entire industry, by law, we are 
going to require you to give away your product to a certain portion 
of the economy while you are trying to sell it to another? 
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Secretary Snow. Senator, those are good questions, and we have 
thought about them. Today, of course, the credit reporting agencies 
are required to make those free reports available under a number 
of circumstances, and they do. The one change we are making is 
to make the annual-upon-request requirement, put that in place. 

I do not think, I mean, we have heard from people who raised 
the issues that you raise, and I think they are legitimate issues. 
In fact, they are issues I raised when I first heard about this pro- 
posal inside the Treasury Department. As I have thought about it, 
on balance, I think it still makes good sense and will not lead to 
an untoward burden on the credit reporting agencies. 

I think we have to be on guard for the unintended consequences 
of the sort you are mentioning and monitor that. In a way, you 
could see where the credit reporting agencies would welcome the 
input on their reports from the consuming public because it would 
make those reports more accurate, and they are in the business of 
providing accurate information. 

So, at one level, I can see where they would embrace it and say 
it really helps us do our basic job, but I think we should be alert 
to some unintended consequences that we, at this point, cannot 
foresee, and be prepared to deal with it if it arises. 

Senator Bennett. As I said, I favor the free credit report, but the 
details have to be looked at. 

Senator Sarbanes. Right. 

Senator Bennett. Thank you, Mr. Chairman. 

Chairman Shelby. Senator Johnson. 

COMMENTS OF SENATOR TIM JOHNSON 

Senator Johnson. Welcome, Secretary Snow. 

So that I do not misunderstand your earlier testimony to Chair- 
man Shelby, it is my understanding that the Administration sup- 
ports a permanent extension of the Fair Credit Reporting Act. You 
observed that you favored a sunset of the Fair Credit Reporting 
Act, which is obviously a termination of the legislation, subject to 
then reauthorization process again. So that I do not have any mis- 
understanding, I wonder if you would clarify the Administration’s 
position. 

Secretary Snow. That may be a distinction without much of a 
difference. The sunsets are in place and will be triggered unless ac- 
tion is taken by the Congress by the end of this year. We favor the 
continuation of the current national standards, which means we 
want the sunsets removed. I used the word “permanent.” 

Congress will, I imagine, continue to monitor this and make im- 
provements over time and deal with issues such as the ones that 
may arise that Senator Bennett talked about. We would like to see 
these national standards extended, with the modifications that we 
have proposed, which is tantamount to saying we do not want to 
see the sunset go into effect. We like the preemption. 

Senator Johnson. As I understand, it would be a permanent ex- 
tension. Obviously, Congress would continue its oversight respon- 
sibilities, which we always do. The Administration’s position is, 
that it would not be an extension of a finite, limited time, but it 
would extend the existing law beyond the current sunset. 

Secretary Snow. Precisely, Senator. 
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Senator Johnson. Legal certainly, I am assuming, is a high pri- 
ority for the Administration relative to the business community 
that they can make plans over the long term, knowing that the 
Fair Credit Reporting Act is not only here, it is here to stay, sub- 
ject, obviously, to the occasional Congressional modifications. 

Secretary Snow. Exactly. We think it would be really devastating 
if the business community could not plan on the preemption stay- 
ing in place. 

Senator Johnson. Do you think that increasing furnisher liabil- 
ity is a useful way of increasing the accuracy of credit reports or 
do you think that such an approach might, in fact, have a counter- 
productive consequence with respect to participation rates? 

Secretary Snow. Again, it all depends on the specifics of the pro- 
posal, but in general I think we have it about right now. I would 
be concerned about higher levels of burdens on furnishers, since it 
is a voluntary system, creating disincentives for them to stay in the 
system. The ability to provide broad-based, low-cost credit really 
depends on lots of furnishers staying in the system. 

I would be very chary and very concerned about changing that 
balance very much. Senator. 

Senator Johnson. Secretary Snow, in your judgment, who would 
stand to lose the most if Congress fails to reauthorize a uniform 
national standard for credit reporting? 

Secretary Snow. Well, I think those who would lose the most are 
those who, today, have been brought into the system over the 
course of the last 7 or 8 years because of the national standards. 
And they, as I think we all know, tend to be more minorities, more 
Hispanics, more African-Americans, more small business owners 
who do business on credit cards. 

It would tend to be the less fortunate, the less financially well- 
established segments of society who would suffer the most. 

Senator Johnson. One of the great strengths of the American 
economy, as opposed to many other economies in the world is the 
mobility and the fluidity of America’s workforce. Would failure to 
extend the Fair Credit Reporting Act have a negative consequence 
on that important piece of our economy? 

Secretary Snow. Senator, I think it would have far-reaching ad- 
verse consequences. One of the great strengths of this country is 
labor mobility, and it is a contradiction to so many other major in- 
dustrialized economies of the world, particularly, say, Germany. 
Something like one-sixth of all our workforce changes locations in 
a given year. 

And as we said earlier, that ability to take your reputation with 
you, to be able to get credit for a house, to get credit for a car, or 
to get credit for shopping and so on is just a powerful part of what 
makes this American economy so fluid and work so well. 

Senator Johnson. Thank you, Mr. Secretary. 

Chairman Shelby. Senator Crapo. 

COMMENTS OF SENATOR MIKE CRAPO 

Senator Crapo. Thank you very much, Mr. Chairman. I too want 
to thank you for holding these hearings. 

Secretary Snow, I want to follow up on one of the answers that 
you gave to Senator Sarbanes when he went through the list of 
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issues that we should he considering here. One of them was the 
privacy issue. I think that raises the whole question of whether the 
Committee should get into the issue of Gramm-Leach-Bliley and 
the privacy provisions that we deal with there. There is a debate 
as to whether there should be an opt in proposal or an opt out pro- 
posal adopted with regard to the sharing of citizens information. 

And it is my understanding that the Administration has not pro- 
posed that we get into that issue. I would like to clarify that and 
find out, if not, why the Administration does not believe that we 
should get into that issue at this time. 

Secretary Snow. Because I think it is premature at this time. 
Senator. That legislation is almost brand new. It is just being im- 
plemented. We are just figuring out how it really works and getting 
acquainted with the ins and outs of Gramm-Leach-Bliley, and the 
experiment, in effect, that it put in place. 

The experiment that you put in place with the FCRA has had a 
lot more experience under it, and I think it is an experiment that 
has clearly proven successful. We know that the results of this ex- 
periment are really superb, terrific. And with some changes that 
we are recommending, we think that it should continue. 

I do not think we are in that position with Gramm-Leach-Bliley 
yet. That experiment is too new, too young. I would urge that we 
give that more time, learn more from the experience under 
Gramm-Leach-Bliley and return to that at some time in the future, 
but not now. 

Senator Crapo. I have in front of me a letter from a number of 
the financial and consumer institutions in Idaho who make the 
point, from their point of view, that we need to have a much more 
readily, comprehensible, and simply executed national privacy no- 
tice of system, so that people can understand what is being done 
with private, financial, medical, and other records about them and 
they can have an ability to control how that information is utilized. 

I want to be sure that I understand your testimony. You are say- 
ing that you think that the issue is not ripe, but not that the issue 
is not one we should approach; is that correct? 

Secretary Snow. Exactly. I think now we should focus on extend- 
ing the Fair Credit Reporting Act with some of the modifications 
that have been talked about, and at the same time, obviously there 
are concerns along the lines you are suggesting. I understand that 
the regulators are working right now: That is, the financial regu- 
lators, at improving those notices. It is a matter of simplifying 
those notices to make them easier to understand and giving the 
consumers a better sense of what their rights are. 

While it is an issue that needs some attention, I think right now, 
from our point of view, the priority is on reauthorizing these na- 
tional standards and making sure they stay in place. 

Senator Crapo. Thank you very much, Mr. Secretary. I think, 
like most Americans who receive these privacy notices in the mail, 
I do not know if very many people read them, I, because I sit on 
the Committee and have a responsibility in this area, actually read 
every privacy notice that I have an opportunity to look at, and I 
have concluded that they are either incomprehensible or unbeliev- 
ably simplistic. 
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I mean, they seem to go from one end of the scale to the other, 
but I do not believe they are accomplishing what we need with our 
citizens in the United States, in terms of their ability to under- 
stand their rights and to define what the rights of Americans are 
with regard to financial information that is maintained about 
them. 

I think we need to address this issue, and I would appreciate the 
opportunity to work with you on this as we move forward. 

Secretary Snow. Thank you. Senator Crapo. 

Senator Crapo. Thank you. 

Chairman Shelby. Senator Carper. 

COMMENTS OF SENATOR THOMAS R. CARPER 

Senator Carper. Senator Crapo and I actually were talking 
about this subject in the last week, and I am glad he has raised 
it here today. I do not know that it is possible to ever have a notice 
from a financial services institution that was almost as simple to 
read and understand as, say, the ability to change your mailing ad- 
dress, but it sure would beat some of the language I have tried to 
wade through myself. I take my hat off to you if you read all of 
those. God bless you. 

[Laughter.] 

I am glad you raised the issue, and, Mr. Secretary, I am glad 
that you were able to let us know from your perspective that you 
think the issue may not be ripe yet, but it is one that I am inter- 
ested in returning to, and I am pleased Senator Crapo is as well. 

Have you ever known anybody in your own family or personal 
friend whose identity was stolen? 

Secretary Snow. Yes, I have. 

Senator Carper. Anybody in your own family? 

Secretary Snow. No, but close friends. 

Senator Carper. We have a niece down in North Carolina whose 
identity was stolen a couple of years ago. She is recently out of col- 
lege, and I think you described the situation and the experience as 
hellish. That is a good description for her and for her family. 

In looking at the experience, and the reason I think why there 
has been a rise in the prevalence of identity theft, a couple of rea- 
sons; one is that it is pretty easy to do. Two, it is fairly lucrative. 
Three, people who perpetrate these crimes are not easily caught. 
And four, if you look at the penalties that people pay for putting 
a lot of people through a hellish experience, the penalties are fairly 
light. 

And I just want to ask you to walk us through the Administra- 
tion’s proposal on this front and describe for us again how it makes 
identity theft harder to do, how it would make it less lucrative, 
how it would enable us to more easily catch those who perpetrate 
these crimes, and how would it stiffen the penalties for those when 
we catch them? 

Secretary Snow. Senator, our recommendations touch a number 
of those matters that you raise. 

First, we would recommend establishing, I guess, for want of a 
better term, we would call it a national security alert system. 

Senator Carper. How would that work? Put this in a practical 
sense. How would it work? Use a real-life example, if you will. 
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Secretary Snow. You have been victimized. All right. You think 
you have been victimized. You can, under our proposal, go to the 
financial institution and, in effect, put a red flag on that. You can 
tell them I do not want you sharing any more of my information 
with anybody, and the way you do this is you go to an authorized 
agency of the State government and get what would be tanta- 
mount, I guess, to a police report that says you have filed a report. 

Now, I think to keep the system honest and fair, you have to 
hold people who would get that police report to a standard of per- 
jury if they are simply making false statements. But once they get 
that government document, probably a number of some kind, the 
financial institution would be precluded from continuing to send 
that information around, and that would help the individual put a 
stop to his identity being used by others. 

And we would also require that once an identity theft had been 
identified, the banking institutions would be required and the 
CRA’s would be required to broadcast that out broadly so that ev- 
erybody would know about it. 

We also think that the banks can do a better job on this, and we 
would have the banking regulators require them to take more re- 
sponsibility for putting in place the capacity to deal with identity 
theft, with fines and penalties for not doing so. 

There are telltale signs. 

Senator Carper. Would you elaborate on that for just a moment 
please, what you just said. 

Secretary Snow. We would recommend that the CRA be amend- 
ed so that banking regulators be required to coordinate with each 
other and develop what you might want to call a system of red 
flags, indicators of identity theft, and there are patterns to identity 
theft, and share these with other regulators so that the banking 
regulators, as a whole, become united in their effort to deal with 
identity theft. 

They become more deeply engaged in the question, in that issue 
of identity theft. They watch for the patterns that the identity 
thieves employ and put up these red flags. Now, the red flag would 
be an indicator that here is the likelihood in this instance that 
somebody is trying to steal your identity. 

And we would ask that the legislation include a requirement that 
the regulators, when they do their audits of the banks, look at the 
question whether the banks are actually doing what they are re- 
quired to do, what the legislation directs them to do, with respect 
to engaging, through this system of red flags and watching for pat- 
terns of identity theft. Just as they do audits of their capital ratios, 
they do audits of their identity theft engagement so that we bring 
this whole issue to a much higher level — put a much higher profile 
on this — and engage the consumers, engage the banking institu- 
tions, and engage the regulators in dealing with this issue. 

Also, we would seek to protect the interests of the victim of iden- 
tity theft by precluding the sale or the transfer of identity theft 
debt. What happens today is somebody sees a red flag. There may 
be an identity theft with respect to some individual. They want to 
make sure they get as much money out of that debt obligation as 
they can, so they go and sell that obligation. 
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What we would suggest doing is precluding, where there is evi- 
dence — reasonable evidence — to suggest identity has occurred, the 
sale or the transfer of that obligation. Once that obligation gets 
sold, that information is repolluting the whole stream of informa- 
tion that is relied on to establish people’s credit, your bad debt 
moves through the system and continues to register to make you 
less worthy of credit. 

Senator Carper. Thanks, Mr. Secretary. 

Chairman Shelby. Senator Dole. 

COMMENTS OF SENATOR ELIZABETH DOLE 

Senator Dole. Mr. Secretary, let me ask you a bit about the De- 
partment’s view of the House legislation, and I want to follow up 
on one of Senator Johnson’s questions here. As you said, our credit 
system is based on a voluntary reporting system in which the fur- 
nishers best interest is to report information to the credit bureaus. 
How do you view the duties that have been imposed on the fur- 
nishers in the House bill? Could any of these jeopardize the willing- 
ness of furnishers to provide information to the system? 

Secretary Snow. Senator, we broadly support the House bill, but 
there are some provisions that do add some burdens that we would 
like to understand better before we embrace them fully because of 
just the issue you raise. We are concerned that we have got to get 
this balance right. 

As you put more burdens on furnishers, you may improve accu- 
racy, you may help protect privacy, you may help security, but you 
also may cause the furnishers to withdraw from the system or be 
reluctant to be in it. Getting that balance right is really important. 

Senator Dole. Well, there are a number of duties imposed on 
furnishers. 

Secretary Snow. There are indeed. 

Senator Dole. The House accepted an amendment which allows 
consumers to go directly to a furnisher to dispute what they believe 
to be incorrect information on their credit report. Does Treasury 
have a position on that language? 

Secretary Snow. We are still looking at that. There may be some 
merit in that approach, and we are still reviewing that question. 

Senator Dole. The 1996 Amendments to the Fair Credit Report- 
ing Act gave credit bureaus the ability to dismiss consumer dis- 
putes that they deemed to be frivolous. Now, if Congress decides 
to allow consumers to register disputes directly with furnishers, 
should we give furnishers the same ability to dismiss frivolous 
suits or claims? 

Secretary Snow. That is again one of those matters that we want 
to understand better. 

Senator Dole. I would like to follow up with some questions to 
be answered in the record. 

Chairman Shelby. Absolutely. 

Senator Dole. Does the Treasury support the provisions in the 
House bill which require the disclosure of the factors used to de- 
velop credit scores 

Secretary Snow. Yes, we do. 

Senator Dole. — ^but still allow for a reasonable fee to be paid to 
receive the credit score? 
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Secretary Snow. Yes, we do. 

Senator Dole. Thank you, Mr. Chairman. 

Chairman Shelby. Senator Corzine. 

COMMENTS OF SENATOR JON S. CORZINE 

Senator Corzine. Thank you, Mr. Chairman, and welcome, Mr. 
Secretary. 

Let me go at a little bit of this view on free credit reports upon 
request, which I think having the consumer informed about what 
their credit standing is, is probably one of the great checks and bal- 
ances to identity theft, to mistaken information — some check and 
balance against how information is put together. 

Why are we resistant to the idea of it not being a more regular- 
ized report to a consumer, so every individual would have, say, 
once a year, look at what is going on in their credit report, particu- 
larly why do we not ask for credit reports to be made available to 
consumers in situations where there has been invasion into their 
consumer activities and identity theft situations, so it can be 
cleaned up. 

When you have one of these situations occur, all of us have ei- 
ther had friends, family, or situations that this has occurred, it is 
extremely expensive. I do not need to go into the detail. 

Why, upon request, as opposed to a periodic review of one’s credit 
information so that you are not surprised when you go off to the 
bank and apply for a mortgage, and they tell you are subprime, 
and you had no idea? 

Secretary Snow. Well, Senator, I think today you can get access, 
free access. 

Senator Corzine. Upon request. 

Secretary Snow. Upon request, in the case of identity theft or 
various other circumstances, such as being turned down for credit 
and so on, adverse events. 

But what we are proposing is that at least once a year you can 
get it free. 

Senator Corzine. If you are aware that there is that potential, 
if you are aware that these things in the whole financial 

Secretary Snow. Well, just if you want it, though. 

Senator Corzine. Right. 

Secretary Snow. Just if you want it, you are able to get it once 
a year. If there is an adverse event, then you can get it today free, 
and we would add one more adverse event, and that is applying for 
credit and getting the credit, but getting it on terms that are less 
advantageous than what you applied for. You apply for the home 
mortgage loan at X percent, and you get X plus 1, you can get a 
free report from the credit reporting agency telling you what lay 
behind that decision. 

Senator Corzine. I think what I am asking, though, is a simple 
thing. Why are we making it the requirement of the consumer to 
request, as opposed to have this be a periodic requirement, the 
agencies to report to the consumer, so you could actually plan. It 
is fine that you just got turned down or you got an extra 2 percent 
on your mortgage, why are individuals required to actually go 
through the system to come to look at the credit officer to have you 
tell them that, as opposed to planning for what your life is about? 
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I think, in the financial world, people have credit rating agencies 
label them AAA, AA. People know what their credit standing is so 
that they can make plans and considerations for how they are 
going to approach credit markets. 

Secretary Snow. Senator, I think the basic answer is people 
should get those reports if they want them. These reports, I am 
told, are dozens of pages. If you do not want the reports, you are 
probably not going to put it to much use, but a burden is imposed 
on the credit reporting agencies sending out 100 million plus re- 
ports a year, whether the consumer wants it or not, and I under- 
line wants it or not. This could be enormously expensive and serve 
no purpose, since most of them would be thrown in the trash can. 

The “upon request” is to get some sense of the user’s interest in 
the report, rather than engaging in what otherwise could be costly 
and useless acts. 

Senator Corzine. Have there been surveys that would confirm 
your view that the consumer would think this was useless and 
automatically be a round file in the wastebasket or is that a pre- 
sumption? 

Secretary Snow. I think if they want the report that they will 
request it. The best evidence of people’s desire for something is the 
fact that they indicate an interest in it. We are providing an oppor- 
tunity for people to request. A lot of people I think would not be 
all that happy to get these reports sent to them — just something 
else they have got to go through and then throw out. If they want 
it, they can get it. 

Senator Corzine. I guess I understand your reasoning, not nec- 
essarily agree. 

Secretary Snow. Thank you. 

Chairman Shelby. Mr. Secretary, before I call on Senator 
Running, I just want to — you did say, as I understood it to a ques- 
tion earlier, that you were in favor of the Administration being in 
favor of making it easier and educating the public on their ability 
to get a credit report. In other words, most people do not know 
that. 

Secretary Snow. Right. Absolutely. Very much so. I said that ab- 
solutely in our response to your questions. 

Chairman Shelby. If they thought they needed one and make it 
accessible to them. 

Secretary Snow. Yes. We need to do a better job on this. 

Chairman Shelby. Absolutely. 

Secretary Snow. I agree with you. 

Chairman Shelby. Senator Running. 

COMMENTS OF SENATOR JIM RUNNING 

Senator Running. Thank you, Mr. Chairman. 

Mr. Secretary, thank you for being here. This is a little off the 
subject of FCRA, but I think I would be remiss if I did not take 
advantage of your presence here to ask a question that is of great 
importance to my State of Kentucky. The IRS recently issued IRS 
Revenue Announcement 2003-46, which effectively separates pri- 
vate letter rulings regarding Section 29 Tax Credits for solid coal- 
based synthetic fuels. 
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This announcement threatens to revoke more than 80 previously 
issued Section 29 letter rulings. Taxpayers, including many Ken- 
tucky coal companies, have invested hundreds of millions of dollars 
in reliance on these rulings. The IRS action has created massive 
uncertainty, making it impossible for taxpayers to earn back their 
investments they made in reliance on this law. 

How does the IRS plan to proceed with this announcement and 
will the IRS lift its moratorium on rulings so that taxpayers will 
be able to use credits as provided by the law? 

Secretary Snow. Senator, my understanding on this issue you 
have raised is that the IRS is looking into the question whether the 
tax credits are being properly applied. I am not an expert on these 
particular tax credits, but some questions have been raised as to 
whether the companies who are using the tax credits are actually 
engaged in the activity that would justify the use of those credits, 
and the IRS has simply, they have not come to a conclusion, said 
they are going to do an investigation of that. 

Senator Running. Well, I am going to follow up with a written 
question on this so that I can get a much more thorough answer 
from the Department of the Treasury on this because it is very im- 
portant to presently 80 previous letters that were issued and 46 
more. We are talking about 126 companies that are being affected 
by this ruling. 

The thing that I am most concerned with on Fair Credit Report- 
ing is how long it takes victims of identity theft to clean up their 
records. 

I mean, we have heard horrendous stories about a year, 2 years, 
and they are still not out of the woods, and I do not know if all 
of the red flags that you talked about are going to get them back 
their good credit rating quicker, but we have to do something in 
this bill that says, by the way, you are a victim, and therefore you 
should not be suffering for 2 years because someone stole your 
identity. 

We have to put something in this bill that will allow the victim 
to get their Fair Credit Report back in 100 percent what it was be- 
fore the theft. Does the Administration feel that this is a major 
problem currently or does it not? 

Secretary Snow. No, Senator, we agree with you 100 percent. We 
would like to obviously make it more difficult at the inception for 
a thief to steal. 

Senator Running. I understand that. 

Secretary Snow. Rut we also agree with your point we would like 
to make it easier to get those records fixed, get those records cor- 
rected as soon as possible, and restore the identity and take people 
out of this hellish situation where they have got to prove their own 
identity. And we have done some things that we think try and get 
at that issue. Certainly, we are open to do other things, and others 
have good ideas as well, and I agree with you. 

I think this is one of the most miserable situations that human 
beings can find themselves in — to know that you are you, and no- 
body else believes you are you, and how do you prove you are you? 

Senator Running. Well, particularly the financial institution you 
may be dealing with for quite a while. 

Secretary Snow. That is right. 
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Senator Running. And others. 

Last, but not least, and my time is running out, I think we need 
much more stringent penalties on those who commit identity theft. 
Does the Administration also feel this way? 

Secretary Snow. Senator, yes. I think anything that discourages 
identity theft raises the bar on people who engage in identity theft 
and certainly should be looked at. I agree. 

Senator Running. Thank you very much. 

Chairman Shelby. Mr. Secretary, before I call on Senator Schu- 
mer, I just want to associate myself with the remarks of Senator 
Running regarding Section 29. He referenced his State of Ken- 
tucky, and so many people have been depending on what they 
heard from the Treasury. In my State of Alabama, we are also a 
big coal producer like they are, and we shared the same problems, 
so I want to join with Senator Running in addressing that problem 
that he posed to you. 

Senator Rennett. We mine coal in Utah, too, Mr. Chairman. 

Chairman Shelby. Absolutely. Same thing, I suppose. 

[Laughter.] 

Rig time out there. 

Secretary Snow. And Maryland has got a little coal as well, I 
know. 

[Laughter.] 

Chairman Shelby. So everybody. 

Senator Schumer, I do not know if you mine coal, but we are 
going to recognize you. 

Senator Schumer. No, we do not have any coal in New York, to 
my knowledge. We have a lot of it, but it is all imported from Ken- 
tucky, Utah, and Alabama. 

Anyway, I want to thank you, Mr. Chairman. Once again, you 
are on the money, so to speak, with an excellent hearing, and you 
are moving along this Committee in a great way, and I think we 
all appreciate it. And I want to thank you, Mr. Secretary, for being 
here. This is the first time you are here, and we all have a whole 
lot of questions. 

I want to ask on an area which we have sent some correspond- 
ence to you, and that is the relationship of trade with China, par- 
ticularly the value of the Chinese currency, the yuan, and the im- 
pact on our job base. 

As you know, 2 weeks ago. Senators Dole and Lindsey Graham, 
myself, and Senator Rayh wrote to you on the subject. I know you 
understand our concern. And you seem to be taking a little more 
of a stand on this issue lately, but we still have not heard a firm 
position from you or the Treasury on whether China’s currency is, 
in fact, undervalued. So I want to ask you the question directly. Do 
you and does Treasury believe that presently the Chinese currency, 
the yuan, is undervalued vis-a-vis the dollar? 

Secretary Snow. Senator, that is the subject of the review under 
the 1988 Trade Act that we are engaged in looking at right now. 
I do not want to make a premature judgment on that. Certainly, 
some economists who studied the matter have reached that conclu- 
sion, and others say it is more of an open question. I, frankly, do 
not have a firm view on that at this point. 
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But, what I do have a firm view on, though, is that we should 
encourage that the Chinese, I mean, and we will turn to Japan in 
a second, we should encourage them, in the reports that they are 
looking at widening the band on the yuan. 

Senator Schumer. But why should they not just let the currency 
fioat? Let me just, first, I have to tell you I am disappointed that 
you do not have a view, and that we are going to wait until a re- 
port comes out in October. Every day, every one of us hear from 
our States of jobs, manufacturing, and otherwise going to China. 

Some of that is on the basis of free trade, but much of it, a good 
deal of it is because the Chinese have unfairly pegged their cur- 
rency to the dollar at too low a rate, and not just of some econo- 
mists, but most economists I talked to, and I have talked to a wide 
range. Democrat, Republican, liberal, and conservative, who believe 
that it is undervalued. The only question is how much? Is it 15 per- 
cent? Is it 40 percent? 

And I do not think, as we lose jobs every day, we can afford until 
October, and then the report will come out, and then you will study 
it, and it may not be until next year that the Treasury even begins 
to take a position on this key issue. 

And I have to tell you, as somebody who has been a free trader — 
I lost the AFL-CIO endorsement when I was in the House for a 
while — free trade is losing ground in this Congress like a sinking 
stone. When you hear that Intel, IBM, and Goldman Sachs planned 
to move high-end jobs to China and India, what is going to be left 
here, restaurants? I mean, the manufacturing jobs are going, the 
agricultural jobs are going. 

I have to say, with all due respect, I do not think it is adequate 
for you to wait until October, and at least myself and others are 
going to push the President and the Treasury not only to come out 
with a position, this is even before a position, but also not to be 
so coy with the Chinese. You know, the Chinese want to be in- 
cluded in the family of Nations when it benefits them, and they do 
not live up to their responsibilities. 

This is not a small little country that needs to peg something to 
the dollar. Their currency should float like everybody’s. What is the 
theoretical objection to having their currency float and determine, 
even if you do not know if it is undervalued or not, the best way 
to do that is to let it float. And what are we doing to get the Chi- 
nese to do that? 

Secretary Snow. Well, Senator, as I indicated to you earlier, we 
are encouraged by the reports that are coming out of China that 
they are looking at employing a more flexible exchange rate re- 
gime. They are to be encouraged in that. But this is an extraor- 
dinarily complex matter. You probably are aware of the banking 
problems and the Chinese economy. You are probably aware of con- 
cerns about overvalued assets on the books of the banks. 

You are probably aware. Senator, of the capital controls that are 
in place, and you are probably aware of concerns that many econo- 
mists have, and many China hands have, that if you moved too 
rapidly in the direction of freely floating exchange rates with the 
removal of capital controls, which of course go hand in hand, as you 
would know, that you would have a huge exodus of yuan into euros 
and into dollars, and of course you know that that would drive up 
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the value of the dollar versus the yuan and drive up the value of 
the euro versus the yuan. 

So this is a very complex question. I think we should encourage 
them to move in the direction they seem to be going. I think we 
should also have some appreciation and understanding of the real 
complexity of this matter and the need to approach it in a really 
thoughtful manner. 

Senator Schumer. I have to tell you, sir, to the tens of thou- 
sands, hundreds of thousands, millions of Americans who have lost 
jobs and who we or you ask us to say, well, free trade benefits ev- 
erybody, to say let us be patient, when the yuan has been pegged 
at an artificial rate for a long time, is not much consolation. 

Furthermore, there is probably manipulation here. You are say- 
ing undoing the manipulation may have bad consequences, but let 
me just quote Chairman Greenspan. He says, “If China’s exchange 
rate is significantly undervalued, and indeed a reflection of that 
would be their [China’s] accumulation of dollar assets. The accumu- 
lation of dollar assets will expand their money supply to the point 
that it will create problems in monetary policy, and it will be to 
their interest to change.” 

So that undercuts the argument you are making. He basically 
says that it is in their interests to even have some of the con- 
sequences. Now, maybe you cannot do it all at once, but when do 
we expect Treasury action on this? The report is coming out in Oc- 
tober. Do you think we have manipulation of the currency by 
China? 

Secretary Snow. Senator, you read the quote from Chairman 
Greenspan, and it began with “if” 

Senator Schumer. Yes. 

Secretary Snow. “If.” 

Senator Schumer. Well, what is your view? 

Secretary Snow. The “if” is what needs to be understood better. 
That is the question. 

Senator Schumer. Well, what is your view? 

Secretary Snow. And the Chairman was very careful in the 
words he chose there. 

Senator Schumer. Yes, he is always careful. I have talked to 
him. 

Secretary Snow. He said, “If” 

Senator Schumer. What is your view? Is China manipulating its 
currency? 

Secretary Snow. Well, I think if the Chairman felt he knew the 
answer to that question, he would not have used the “if” 

Senator Schumer. But I would like to know your view. 

Secretary Snow. I have an “if” as well. 

Senator Schumer. Well, I do not think these answers are satis- 
factory, with all due respect, sir. We are going to lose not just jobs, 
you are going to lose, my guess is, a free trade consensus in this 
Congress very, very rapidly, and this is a proeconomic, profree 
trade way to restore some of the imbalance because this is an un- 
fair part of the imbalance, and I do not think your patience with 
this, with all due respect, is shared by Members on both sides of 
the aisle in this Committee and elsewhere. 
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Secretary Snow. Senator, when we report to you in October, 
which is only a couple of months away, we really want to know the 
facts. We want to give you a thoughtful, well-considered, and ana- 
lytically sound answer to the question, the question that the Chair- 
man aptly notes is an “if.” 

We have to pay careful attention to this issue, though, of manu- 
facturing, the whole problem of currency manipulations or the 
problem of undervalued currencies, to the whole question of coun- 
tries promoting their export sectors at the expense of the world 
trade system. It is not really in their interest to do so. No country 
has ever devalued itself to prosperity, and the issues the Chairman 
raised, and the issues I have talked to him about in that same vein 
are important. They are critically important issues. And there is 
the potential for an imbalance in the whole trading system if coun- 
tries build up excessively large reserves because they are sup- 
pressing the value of their currency. 

We are in full agreement. We recognize the issue. We want to 
come back and have a dialogue with you and with our friends in 
China on this question. And if, in fact, the yuan is being held at 
a considerably lower than market value, then it is not in their long- 
term interests, and we want to have that dialogue with them. 

I do think, though, we have to recognize that some of the loss 
of manufacturing is due to a variety of other things. I think you 
would acknowledge that. There has been a long-term downward 
trend in manufacturing in the United States over the last 50 years. 
A part of that is due to rising productivity itself in the manufac- 
turing sector. Part of it is due to the rise of technology. A lot of 
it is due to domestic competition. 

The whole question of manufacturing, and its role in our econ- 
omy, and where it is going, and what can be done to assist it are 
serious issues that Secretary Evans is engaged in, that I am en- 
gaged in, and that we hope to come back and put in better perspec- 
tive for the Congress. 

Senator Schumer. Thank you, Mr. Secretary. 

Chairman Shelby. Senator Dole. 

Senator Dole. Mr. Chairman, I just want to associate myself 
with the comments of Senator Schumer. Because no question about 
it, our textile industry in North Carolina has been decimated, and 
I do believe that time is of the essence, Mr. Secretary, and that, 
yes, there are a number of causes, but certainly Chinese currency 
manipulation is something we must move on. I do not think we can 
wait. And also I recalled the comments of Chuck Hayes, who 
passed away about a year ago, he was head of the Textile Institute 
in North Carolina, head of one of the top companies, which has 
gone down. 

He said, if the transshipments from China — or he did not men- 
tion China, specifically, but we know that is where most of them 
are coming from — these illegal transshipments had been half what 
they had been, then our textile industry would be thriving in North 
Carolina, and of course it has been decimated. 

So a number of these issues go back to the Chinese, and I just 
want to associate myself with the comments that you have made 
today and hope that we can get some speedier action on this. 

Chairman Shelby. Thank you. Senator Dole. 
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Senator Sarbanes. 

Senator Sarbanes. Just to close out this issue. Obviously, it is 
a matter of very deep concern here in the Congress. 

Senators Levin and Voinovich are also addressing Japanese ma- 
nipulation of currency. The Government of Japan intervened in for- 
eign exchange markets 24 times in the month of May alone, spend- 
ing $43 billion in order to keep the yen weak against the U.S. dol- 
lar. In effect, this amounts to a Government subsidy of its major 
exports. So the issue runs not only to China, but to Japan as well, 
and I share the concern my colleagues have expressed and the need 
for the Treasury to act on it now, promptly. 

In any event, it is very clear that this hearing that the Chairman 
has indicated is going to be held after you prepare your report, is 
going to be a very, very important hearing because, obviously, at 
that point, you are not going to be able to sit at the table and say, 
well, we have not finished our study yet. 

But I think this situation is urgent enough that you need to be 
doing things in the interim. It seems pretty clear we are being 
taken advantage of, in terms of the rules of international fair 
trade. 

Secretary Snow. Senator, as I indicated earlier, we have indi- 
cated that we are encouraged by the fact that the Chinese, very 
high levels of their Government, have indicated an interest in wid- 
ening the peg, widening the ban, and we are encouraging them to 
do so. 

We are also encouraging them to think about, though, the finan- 
cial infrastructure of the country, so that as they move in that 
direction, there are parallel developments with respect to the bank- 
ing system and capital controls, and so on. 

Of course, it is I guess worth noting that during the period of the 
Asia currency crisis, where there was so much concern about sta- 
bility, and contagion and all of those issues, the Chinese main- 
tained the peg, and of course that had the effect of, at a time when 
all of the other currencies were falling, of making their currency 
more valuable, since it is tied to the dollar, and the dollar sus- 
tained its value. 

So these, again, I come back to the fact we recognize there is an 
issue here. It needs to be addressed. We are addressing it. We are 
encouraged by some developments. We would like to encourage fur- 
ther developments, and we will be having a dialogue on this subject 
and are having a dialogue on this subject, a dialogue that is prob- 
ably best conducted with the parties directly, though. 

Senator Schumer. Mr. Chairman. 

Chairman Shelby. Sure. Go ahead. Senator. 

Senator Schumer. Thank you. 

I would just like to follow up briefly because it is an issue that 
concerns a good number of us on both sides 

Chairman Shelby. All of us 

Senator Schumer. — both sides of the aisle here. 

First, here is the United States’ position right now — this comes 
from the last time this report was issued. Treasury’s Report to 
Congress on International Economic and Exchange Rate Policy, 
dated May 3, 2002 — “No major trading partner of the United States 
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manipulated exchange rates under the terms of Section 3004 of the 
Act during the period July 1, 2002, through December 31, 2002.” 

Right now, our position is that there is not currency manipula- 
tion. Now, you say, well, that is not now, it is then, but the yuan 
was still pegged at that time. 

Second, I am just going to ask three quick questions and ask 
your comments. This is the first one. Is that still our official posi- 
tion? Do we have to wait until October to say? Because the Chinese 
were given a clean bill of health. 

Two, Greenspan said, yes, if they were manipulating the cur- 
rency, there was an “if,” but he said that, then, their money supply 
would accumulate, that that would be an indication, and we know 
that China’s reserves are going up, up, up. I think the IMF esti- 
mated them at $350 billion, China’s reserves. This is as clear as 
the nose on your face that it is an example of currency manipula- 
tion, and at the same time, we are saying, no. And I would just add 
to you one of the reasons the Chinese financial system is messed 
up is because they have pegged their currency. It is not unpegging 
it that will mess it up, it is that they have pegged it, and that has 
messed it up, and that is what happened. 

And three, I would ask you this: Is there any indication, other 
than verbiage, because I have been through this with the Chinese 
and the Japanese on trade before, we get 5 years of verbiage before 
you get a single bit of action. 

And this idea of “leave it to the big boys” to just discuss this 
quietly? Not me. I have had it that way. I left it to the big boys 
to open up Japanese financial markets for 5 years, nothing hap- 
pened. I started raising my voice, and within 6 months. New York 
firms were allowed on the Japanese stock exchange. So, I learned 
it the hard way, and I am not going to be fooled again. 

Have the Chinese done one single thing that changes what their 
currency is or have they just said they might explore it? 

So those are the three questions. I apologize for being excited 
about this, but when I read last week that Goldman Sachs was 
moving 2,500 jobs, not low-end jobs, high-end jobs, and Intel said 
they can get an engineer in India for $5,000, not $60,000, here in 
America, what is going to be left here? This is something we have 
to act on quickly. I apologize. 

Secretary Snow. Good, Senator. I understand what lies behind 
this line of questioning and am in deep sympathy with what moti- 
vates it by you, and by Senator Dole, and really by the whole Com- 
mittee. 

You know where this Administration is. We favor fairly fluc- 
tuating exchange rates. We think they work better. We think they 
make the international trading system better, and we think they 
add to the stability of the whole global monetary system. 

Senator Schumer. Have we ever asked the Chinese to change? 
We always talk about this in, excuse me, in broad terms. We gen- 
erally favor floating rates, and then when it comes, and you are 
asked, “What are you doing about China,” or even “Should China 
change?” we go back to the “generally we believe in.” That is not 
going to get us anywhere. 

Secretary Snow. Well, Senator, as you know as well or better 
than I, the decision, with respect to the currency regime that a 
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country adopts, is a sovereign decision. The United States cannot 
dictate to another country what currency regime they employ. 

I think, though, we can have a good dialogue with them, and the 
circumstances are a little different now. Those foreign reserves are 
at much higher levels than they were when that prior report was 
written. 

And as Chairman Greenspan so well stated, it is really not in a 
country’s long-term interest to acquire a disproportionate amount 
of foreign reserves because that is capital. That is capital that 
could go into the domestic economy. 

And we are very strongly of the view that countries cannot de- 
value their way to prosperity. They have to develop their domestic 
economies, and taking capital out of your economic system and put- 
ting it into owning foreign reserves over somewhere does little to 
develop the domestic economy. 

I believe we are in a heated agreement here. 

Chairman Shelby. We hope so. 

[Laughter.] 

Mr. Secretary, we do look forward, again, to your October meet- 
ing. And I will tell you this, that meeting here will be well at- 
tended, not only by the press of the world, but by the Committee 
Members because we all are concerned — Senator Dole, Senator 
Schumer, I guess just about all of them are concerned about what 
is going on. 

Secretary Snow. Thank you, Mr. Chairman. 

Chairman Shelby. Mr. Secretary, we want to thank you for your 
appearance today and look forward to your next one in October. 

Secretary Snow. Thank you very much. 

Chairman Shelby. Thank you. 

We will now go to our second panel, and they have been very pa- 
tient here. Mr. Edmund Mierzwinski, Consumer Program Director, 
U.S. Public Interest Research Group, and Mr. Michael McEneney, 
on behalf of the U.S. Chamber of Commerce; is that right? 

Mr. McEneney. McEneney. 

Chairman Shelby. McEneney. 

In the interest of time, gentlemen, your written statements will 
be made part of the record. I am hoping you will sum up your basic 
points as quickly as possible. We will start with you. 

STATEMENT OF MICHAEL F. McENENEY 
PARTNER, SIDLEY AUSTIN BROWN & WOOD, LLP 
ON BEHALF OF THE U.S. CHAMBER OF COMMERCE 

Mr. McEneney. Good morning, Mr. Chairman, Senator Sar- 
banes, and Members of the Committee. My name is Mike 
McEneney, and I am a Partner at the law firm of Sidley Austin 
Brown and Wood. I am pleased to have the opportunity to appear 
before you today on behalf of the U.S. Chamber of Commerce. I 
would like to commend the Members of the Committee for their 
work in examining key aspects of the ECRA. 

The ECRA and its national uniform standards have provided a 
robust framework for the most advanced consumer credit and in- 
surance markets in the world. Indeed, the benefits of the ECRA 
were highlighted in a recent Information Policy Institute study 
which found that the national uniform standards established by 
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the FCRA have contributed significantly to the consumer benefits 
of the current credit marketplace. The study concluded that the 
loss of the existing framework of uniformity would threaten the 
current consumer benefits and that Congressional action is nec- 
essary to ensure the continuity of our national standards. 

The national standards established by the FCRA are also an im- 
portant component of protecting the security of consumers’ personal 
information. For example, the national uniform provisions under 
the FCRA ensure that financial institutions can have access to reli- 
able credit report information for identify verification and other 
identity theft prevention measures. Although renewal of the 
FCRA’s national uniform standards is an important step, we be- 
lieve that more can be done. 

For example, this Committee has heard testimony highlighting 
the issues of identity theft and consumer education. The Chamber 
strongly supports efforts to address these important issues and 
looks forward to working with the Committee to achieve these 
goals. 

With respect to identity theft, we believe there is a common 
theme that may be helpful in guiding considerations of provisions 
to combat the problem. In particular, the methods used to address 
potential identity theft scenarios should be flexible, allowing com- 
panies to utilize the most efficient means to thwart identity 
thieves. Such an approach would rely on the obvious fact that a 
one-size-fits-all approach may not work for all companies. For ex- 
ample, the red flags presented by identity thieves will invariably 
change over time, and the tools used to combat identity thieves 
should change as well. We hope this theme could be further ex- 
plored as part of the Committee’s deliberations. 

Another topic that has been raised is the important issue of a 
consumer’s ability to access his or her credit report. The Chamber 
welcomes consideration of how to make credit reports more avail- 
able to consumers. We believe, however, that this issue requires 
careful study before next steps are taken. In particular, there 
should be a full examination of the costs associated with additional 
free reports in order to ensure that there are no unintended con- 
sequences, particularly for consumers. 

Moreover, if consumers are given access to their credit reports 
free of charge, the frequency and volume of demand for free reports 
will be difficult, if not impossible, to predict since a widely cir- 
culated press report or e-mail could drive extremely high volumes 
of demand in short periods of time. Given such inherent unpredict- 
ability, it is unclear how credit bureaus would be in a position to 
adequately manage this problem. For example, even the most basic 
issues, like establishing adequate staffing levels, are difficult to ad- 
dress when you cannot predict the volume of demand. 

The Chamber also encourages the Committee to consider legisla- 
tion that would make it clear that companies can conduct inves- 
tigations of wrongdoing in the workplace without the inappropriate 
application of the FCRA. Because of the difficulties in conducting 
an investigation while complying with the FCRA’s requirements, 
the FTC’s interpretation on this issue deters employers from using 
experienced and objective outside organizations to investigate 
workplace misconduct. The FTC interpretation I am referring to 
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here is one that would actually cause an accounting firm or a law 
firm that is hired by a company to help in investigating workplace 
misconduct, that accounting firm or law firm, by reporting the re- 
sults back to the employer under this FTC interpretation, might ac- 
tually become a consumer reporting agency; and the Chamber 
urges amendments to the FCRA to make it clear that that is not 
the case. 

Before concluding, I would like to just briefly address certain 
issues that have come up in the context of affiliate sharing. 

First, I have heard it mentioned that perhaps affiliated entities 
might be establishing their own credit bureaus and operating free 
from the scope of the FCRA. Actually, that cannot happen. If affili- 
ated entities were to establish a credit bureau and, for example, 
sell information to third parties the way that credit bureaus do, 
they would be subject to the full range of provisions of the FCRA, 
and they would be regulated as a credit bureau would be. 

Second, in my experience, affiliated entities have no desire to set 
up credit bureaus within their affiliated families, and there are sig- 
nificant limitations on their ability to do so, I would add. For exam- 
ple, they only see part of the picture with respect to a particular 
individual’s credit history or financial experience because they do 
not see the experience that others have at other organizations. 
They do not see the public record information that can be vital to 
making credit decisions. 

The real purpose of affiliate sharing is to know enough about 
your customers to give your customers what they want. And the 
real purpose of the affiliate sharing exercise is to expand or en- 
hance customer relationships, not limit them, not to use the infor- 
mation to deny people credit, or otherwise limit the relationships. 

Now, although risk assessment can be an important part of that 
process, to my knowledge, affiliate sharing entities typically do not 
deny people credit or other products based on the information they 
get from other affiliates. The reason for this is simple: They only 
see part of the picture. What they typically will do is go out to a 
credit bureau to obtain a consumer report before that type of deci- 
sion is made. 

Just one final note on affiliate sharing. I am aware, though, that 
affiliates will use information in an affiliate sharing context to 
grant people credit or other products where they cannot find infor- 
mation at the bureau on that individual. So where, for example, an 
individual is just starting out their financial history, they do not 
have a file at a credit bureau, there are entities that, through affil- 
iate sharing, may know more than the credit bureau would on that 
individual. And I am aware of at least certain circumstances under 
which affiliates will use that information, again, to expand or en- 
hance that relationship with the individual. 

Once again, I would like to commend the Committee for its ef- 
forts to maintain the consumer benefits of our current financial 
marketplace while also protecting the security of consumers’ per- 
sonal information. The Chamber looks forward to working with the 
Members of the Committee as any legislation moves forward. 

Thank you again for the opportunity to appear before you today, 
and I would be happy to answer any questions. 

Chairman Shelby. Sir, go ahead. 
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STATEMENT OF EDMUND MIERZWINSKI 
CONSUMER PROGRAM DIRECTOR 
U.S. PUBLIC INTEREST RESEARCH GROUP 

ON BEHALF OF: 

ACORN, CENTER FOR COMMUNITY CHANGE, CONSUMER ACTION 
CONSUMER FEDERATION OF AMERICA, CONSUMERS UNION 
ELECTRONIC PRIVACY INFORMATION CENTER 
IDENTITY THEFT RESOURCE CENTER 
NATIONAL CONSUMER LAW CENTER 
PRIVACY RIGHTS CLEARINGHOUSE, PRIVACY TIMES, AND 
U.S. PUBLIC INTEREST RESEARCH GROUP 

Mr. Mierzwinski. Thank you, Chairman Shelby, Senator Sar- 
banes, Members of the Committee. I am Ed Mierzwinski, Con- 
sumer Program Director with U.S. Public Interest Research Group. 
My testimony today is on behalf of the Nation’s leading consumer 
and community and privacy organizations, including ACORN, the 
Center for Community Change, Consumer Action, Consumer Fed- 
eration of America, Consumers Union, the Electronic Privacy Infor- 
mation Center, the Identity Theft Resource Center, the National 
Consumer Law Center, Privacy Rights Clearinghouse, Privacy 
Times, and we are all united. We have all been working on this, 
and we appreciate that the Senate has asked for our views before 
it develops its own comprehensive solution to the problems identi- 
fied in your set of detailed hearings. 

We want to make sure that credit reports are accurate, that con- 
sumer privacy is protected, and that identity theft is stopped. All 
the indicators show that identity theft is up, Mr. Chairman. Just 
this week, the distinguished Professor Alan Westin reported that 
millions of Americans — not hundreds of thousands, as most pre- 
vious reports have identified. Millions of Americans annually are 
probably victims of identity theft, and the crime costs consumers 
billions of dollars a year. 

Consumers are the victims, as your hearings have pointed out. 
Industry has in the past claimed that they are the victims because 
they eat the costs. Consumers are the victims because of the emo- 
tional distress, the time, the inability, as Captain Harrison pointed 
out to the Committee, of being able to clear 61 fraudulent accounts 
from his good name. 

We also know, in terms of identity theft, that the Federal Trade 
Commission has documented that identity theft is up and that it 
is at higher levels every year. 

Also, this week, you may have seen that yesterday the Federal 
Trade Commission imposed a $250,000 civil penalty on the Equifax 
Credit Bureau for violating the terms of a consent decree, where 
it was supposed to have enough people on staff to answer the 
phone and help consumers. I am, quite frankly, astonished, Mr. 
Chairman, that during the terms of a Congressional review of this 
industry — and this industry is seeking all kinds of favors, seeking 
preemption forever — that they would get caught violating a consent 
decree; and at the same time they are arguing that if you are going 
to provide consumers with greater rights, the first to a free credit 
report, for example, that you have to be careful that you do not im- 
pose too many duties on them. They are not even complying with 
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their current duties to answer the phone, so I am quite dismayed 
that the credit bureaus are asking for additional time on the free 
credit report. 

I would also point out to the Committee that this week the Pri- 
vacy Times broke a story that suggests that the credit bureaus are 
moving jobs offshore. I think the Committee should look into that 
before it drafts its bill. I am very concerned. Identity theft is often 
an insider game. If they are moving jobs to low-wage countries, 
there may be greater opportunities for identity theft. There is real 
secret — I am sorry, confidential information in credit reports, and 
I think you should scrutinize very carefully this proposal by the 
credit bureaus to move our confidential consumer records offshore. 

The consumer groups think it is the wrong time to grant perma- 
nent preemption for a number of reasons, and we think that, as 
you pointed out in your opening statement, ongoing Congressional 
review is a good idea. The biggest problem we have in this Con- 
gress is inertia, and having a reauthorization every 4 years or so 
seems to be a good idea. We would, of course, support removing the 
preemption and just letting it expire. But if you are not going to 
do that — and the House chose not to do that — at least this Com- 
mittee should consider sunsetting the preemption. 

This week, disappointingly, a District Court Judge in California 
overturned parts of the San Mateo and Daly City privacy ordi- 
nances which were enacted under the broader pro-privacy, pro- 
state authority terms of the Sarbanes Amendment to the Gramm- 
Leach-Bliley Act. We would also ask that the Committee reiterate 
its 1996 Congressional history that the preemption in the Fair 
Credit Reporting Act as it pertains to affiliate sharing was narrow 
and does not affect the Gramm-Leach-Bliley Act and the right of 
the States to enact stronger financial privacy laws, so long as the 
States do not attempt to enact laws that turn those companies into 
credit bureaus when they share information. 

I also want to point out that I find it somewhat hypocritical of 
the industry to be saying that they want flexibility because they do 
not want one-size-fits-all for their companies, but they do want one- 
size-fits-all for the laws. So they want the law to be national; they 
do not want the States, who have been demonstrated to be engines 
of change, laboratories of democracy, all the good ideas in the mod- 
est House bill have already been enacted in State law to a large 
extent. Yet industry does not want one-size-fits-all. They want 
flexibility in the rules. It is a little surprising. 

My testimony goes into a number of key reforms, Mr. Chairman, 
that I will not go into now, but we believe the House bill does not 
go forward adequately enough. It does not provide enough trans- 
parency. It originally was supposed to provide free credit reports 
and free credit scores. It now no longer provides free credit scores. 

I spoke with a leading lender yesterday, a leading executive of 
a leading lender, and he told me he would like much greater oppor- 
tunities to provide consumers with free credit scores. But he is pro- 
hibited by contracts that prevent him from doing so. We think that 
the scores should be free along with reports, and they should be 
provided by all credit bureaus. 

We think the FTC should be required to audit the companies an- 
nually and to publish the results of those audits to the public. 
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We believe that the consumers should have availability of more 
scores, and this is outlined in our testimony — I am sorry, more re- 
ports and more scores. And it is also something that is supported 
by the FTC and, I believe, the Treasury Department. There are cir- 
cumstances in the economy where today we accept a counteroffer 
and we do not receive a credit report. We should get a credit report 
when we accept a counteroffer. We should also get a credit report 
when a company like Citibank makes a decision based on a profile 
internally. And while we may disagree, my colleague and I here at 
the table, over whether the companies will eventually want to set 
up their own internal credit bureaus, they, in fact, are using infor- 
mation derived from affiliate sharing for credit profiling, according 
to Citibank’s testimony last month. When that happens, you do not 
have the same rights as you would if they used a full credit report. 

In terms of accuracy, we make a number of recommendations to 
the Committee. I am very disappointed in the GAO report, Mr. 
Chairman, because it ignores the fundamental findings of the larg- 
est and peer-reviewed study that has been provided in testimony 
to this Committee. The CFA’s study, the Consumer Federation of 
America’s study, looked at half a million credit files and found that 
29 percent of consumers had a disparity of 50 points or more on 
their credit scores if obtained from one or another of the three re- 
positories. I believe that the findings of that CFA study, which, 
again, was peer-reviewed and is a legitimate, academic-level, sta- 
tistically valid study, in my opinion, should have been discussed in 
greater detail in the GAO’s findings. 

The other studies that I would like to point out to the Com- 
mittee — and I would like to make sure that they are in the record 
if they are not already — the industry has relied on a number of 
white papers, a number of studies that claim or purport that there 
will be billions of dollars of cost to the economy if we do not do 
what they want done. 

I would say that Robert Gelman, a noted privacy expert, has pre- 
pared a study on the costs of not protecting privacy. And Professor 
Elizabeth Warren of Harvard Law School has prepared a study re- 
butting a number of the proprietary industry white papers as a 
way to make public policy. And, in addition, our proposals talk 
about the need to have better credit score models transparency as 
well. We do not know enough about credit scores. We do not know 
enough about how they are made. As your testimony, however, 
pointed out on Tuesday, we do know that your credit limit is part 
of your credit score, and that when your credit limit is withheld by 
a furnisher, that is a problem for the consumer. 

So there is a very important study by the civil rights group, the 
Center for Community Change, called “Risk or Race,” that finds 
that, in fact, risk may not be the factor that has black and His- 
panic applicants disproportionately mentioned in subprime lending; 
that is, if you are black or Hispanic, you are more likely to be pay- 
ing too much for a loan. And that study, “Risk or Race,” should be 
entered into the record. 

Our testimony goes into a number of other important details 
about changes that need to be made in the act. Our groups hope 
to work closely with you and Senator Sarbanes on solutions to 
these important problems. But at a very minimum, we strongly op- 
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pose the permanent extension of preemption. We think it is un- 
justified. We urge the Committee to go for a sunset rather than 
permanent preemption. 

Chairman Shelby. Thank you. 

We have seen indications that some creditors do not report infor- 
mation regarding their customers to the credit bureaus. You ref- 
erenced that. What do you believe is their motivation for this? 

Mr. Mierzwinski. Well, very clearly, the motivation is to game 
the credit scoring system to prevent those customers from shopping 
around. If I want to apply for credit, I want the best credit score 
I can have. But the easiest thing for a company to do is not to look 
for new customers, but to keep its existing customers. That is why 
they do it. 

Chairman Shelby. But if they do that, you cannot have accuracy 
in scoring, could you? You do not have all the information. 

Mr. Mierzwinski. We do not believe you can have accuracy in 
scoring, and the fact is even though the so-called black box of the 
credit scoring models is secret to you and me, the companies know 
enough about it to know that if they withhold certain pieces of in- 
formation that they can game the system. And there is a lot of mo- 
tivation there because if they keep their customers, most of those 
customers are probably paying too much for the 

Chairman Shelby. It is to their benefit, but perhaps to the loss 
or detriment of the consumer. 

Mr. Mierzwinski. It is absolutely to the loss or detriment of the 
consumer to be prevented from being able to shop around. And it 
is also to the loss or detriment of the credit scoring system. 

I think a bigger threat to the uniformity of the system, to the vol- 
untary nature of the system, than the States, who I think are ra- 
tional actors, is these acts of companies to prevent their consumers 
from being able to shop around. 

Chairman Shelby. Do you believe it is important to establish 
some kind of baseline, that is, objective information regarding the 
level of credit report accuracy? 

Mr. Mierzwinski. I absolutely think that you need to establish 
a better baseline on credit report accuracy, and I know the GAO — 
again, I disagree with their finding, but they say more needs to be 
done, that the FTC or the agencies, the bank agencies, or the credit 
bureaus should do more of a study. 

I personally feel that the annual audits of credit bureau accuracy 
should be provided and the public should hear about them. The 
Committee should hear about them as well. 

Chairman Shelby. We have also learned here a lot about — but 
we do not know everything about it — the growing use of risk-based 
pricing. Adverse action notices are not provided as regularly, we 
have been told, as they once were. 

I believe that consumers are never more aware of the need to re- 
view their credit report than after they have been jolted, perhaps 
jolted to the awareness of some kind of credit-related problem. 

Do you agree? And do you think it is necessary to update the ad- 
verse action notice process to meet today’s realities? 

Mr. Mierzwinski. You are exactly right. We agree. I believe that 
the agencies, the Treasury and the FTC, also agree, or at least on 
that one the FTC agrees. 
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The old credit system was yes or no. Now the credit system is 
more or less. You pay more or you pay less. If the system is inac- 
curate, you probably pay too much. But in many cases, when you 
are paying more, you do not know that it is because of a mistake 
on your credit report because you are not receiving the adverse ac- 
tion notice. 

Chairman Shelby. The whole system is based on accuracy, 
which is truth, is it not? If somebody is gaming the system for pro- 
prietary reasons, withholding information, the consumer is going to 
get hurt. 

Mr. Mierzwinski. Well, the consumer gets hurt, but it is an ex- 
ternality to that company. That company benefits by charging that 
consumer too much. They are happy. 

Chairman Shelby. Sir, going forward, how can we best ensure 
that entities involved in the credit granting process continue to 
meet their Fair Credit Reporting Act responsibilities? 

Mr. McEneney. Mr. Chairman, I think that probably the best 
way to do that is the continued active, vigorous enforcement of the 
existing statute. The statute really is a remarkable piece of legisla- 
tion, providing powerful protections to consumers. The credit bu- 
reaus that have information on them are under an obligation to 
maintain reasonable procedures to ensure the maximum possible 
accuracy of that information. Consumers’ access to that informa- 
tion, the ability to dispute it, the ability to demand that the 
furnisher 

Chairman Shelby. Ability to dispute it and clear it up if it is 
wrong, right? 

Mr. McEneney. Clear it up if it is wrong, absolutely, and includ- 
ing involving the furnisher, the entity that provided the informa- 
tion to the bureau, in that process. 

Chairman Shelby. Well, how do we change that a little? We had 
this gentleman, this Army Captain, retired, that had a horror 
story. It just ruined his life, basically, trying to deal with identity 
theft and all this. There should be an easier way to clear up some- 
body, because they steal your identity. And the Secretary of Treas- 
ury testified here today, as you know — you were here — that this is 
a big and growing problem. 

Mr. McEneney. I could not agree with you more strongly, Mr. 
Chairman. I think if you take — virtually every anecdote I have 
heard about accuracy that is not related to identity theft can really 
be addressed by the proper application of the existing statute. But 
identity theft is really where the statute, unfortunately, has a 
weakness. 

Now, in that regard, I think that many in the industry, and I 
think to a certain extent the people in the Administration as well, 
have looked at a way to try and make it easier for those people who 
are the victims of identity theft to get it cleared up quickly. Prob- 
ably the most powerful tool that consumers could have in that con- 
text is the trade line blocking. 

Now, the way the trade line blocking works is the consumer, for 
example, files a report. A police report is one standard that has 
been talked about. Whatever the standard is, it has got to be a 
credible one to avoid credit repair clinics from using it to game the 
system. But assuming that we can come up with a credible thresh- 
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old — and I think we can — what that would do is then enable that 
consumer to take that report, go to the bureau, file that report, and 
block for all time 

Chairman Shelby. And not have the horror stories we have had 
here. 

Mr. McEneney. Absolutely. 

Chairman Shelby. And I am sure there are thousands. 

Mr. McEneney. Yes, absolutely. And, Mr. Chairman, could I just 
comment on a few other questions that you raised earlier? 

Chairman Shelby. Absolutely. 

Mr. McEneney. I am familiar with the issues regarding the re- 
porting of credit limits, and my understanding of the motivation 
behind those issues — and I am not defending that practice, but 

Chairman Shelby. Please do not. 

Mr. McEneney. But it is a little different than I think my col- 
league at the table may have described. As I understood it, I 
thought that some banks thought that they may have come up with 
a clever proprietary way to set credit limits and did not want to 
tip their hand to their competitors that they had come up with this 
methodology. 

I do not think it was designed to prevent their customers from 
shopping. After all, if that was their intent, they would not report 
anything on those consumers at all. 

Chairman Shelby. Well, why not report everything for accuracy? 
How can you have accuracy if you are gaming the system, even if 
you want to rationalize for proprietary reasons, and keep you or 
you from shopping in the market? 

Mr. McEneney. I agree with you. 

Chairman Shelby. Because the market does not work if you do 
not have it open. 

Mr. McEneney. I agree with you that full reporting should be 
encouraged. I think requiring it may have some adverse con- 
sequences that outweigh the benefits. 

Chairman Shelby. Like what? 

Mr. McEneney. One of the things that happens if you man- 
date — today, we have a voluntary system that I think works ex- 
tremely well, and I think there is substantial evidence for that be- 
cause of the incredibly successful rate at which creditors are able 
to grant credit and get paid based on 

Chairman Shelby. We like all that, but we like accuracy, which 
is based on the truth. 

Mr. McEneney. And I think that the way the system works 
today is extremely effective. Creditors grant credit. They get paid 
back. I think that supports the notion that the information they 
have today, although not complete in some cases 

Chairman Shelby. Well, we all agree that the system is working 
pretty well. But where it is not working well, I think it is our re- 
sponsibility to clear it up. And you can help us. 

Mr. McEneney. And I am prepared to help you, Mr. Chairman, 
and the only thing I would say is that I think encouragement or 
persuasion in this regard will likely provide the benefits you are 
looking for without significant detrimental impacts, like driving 
people from providing the information in the first place. 

Chairman Shelby. What is wrong with mandating it? 
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Mr. McEneney. There are a number of questions that come up 
in that context. One is: Who do we mandate provide the informa- 
tion? There are thousands and thousands of furnishers of informa- 
tion out there. And then what do they provide? For example, small 
businesses have certain types of information. Utility companies 
have different types of information. Credit card companies have dif- 
ferent types of information. Mortgage companies. What is it that 
constitutes full file? 

Also, who do they provide it to? There are hundreds of credit bu- 
reaus around the country, and do we only mandate that it be pro- 
vided to certain credit bureaus and not others? 

Also, I think one of the things that has to be assessed is the po- 
tential impact on the reliability of the information. Today, people 
provide the information voluntarily because they are willing to 
build the infrastructure to do so; they are willing to incur the costs 
to deal with follow-up disputes. If you force people to do it where 
those people have not build those infrastructures to support the re- 
porting of the information, I think there is a significant risk that 
it could actually decrease the reliability of the information you get. 

Chairman Shelby. Well, I disagree with you on that. 

Even if the motivation is not to so-called game the system, 
shouldn’t we be concerned if the effect hurts the consumer? In 
other words, the consumer — there are a lot of choices out there in 
the marketplace, and you have got different firms fighting for that 
customer. But if somebody is withholding information which keeps 
their customer base in line where they might have an opportunity 
to do a little better somewhere else, I think it games the system 
and the free market does not work. 

Mr. McEneney. Well, I would say on that point that one of the 
things that I think people should look into in that context is the 
extent to which those issues can be dealt with through modeling. 
One of the great things about credit scoring is that if you know 
what you do not know, you can model for it. You can assess what 
it means over time. And I do not think we are talking about sys- 
tematic problems in the reporting of this information. I think we 
are talking about exceptional situations that are a small minority 
of the circumstances. And I think that can be dealt with through 
proper modeling. 

Chairman Shelby. At the very least, the banking regulators 
could ensure that entities that they supervise full-file reports. They 
could do that. 

Mr. McEneney. And I think they are strongly encouraging that, 
Mr. Chairman, and I think it has been effective. For example, the 
Fed did a study on this issue sometime back, and between the time 
that they gathered the information from the credit bureau to figure 
out what the credit reporting looked like and the time they pre- 
pared the report, the number of accounts that did not have the 
credit limit on them went from something in the neighborhood of 
35-plus percent down to 13 percent. And my understanding is that 
that friendly or not-so-friendly persuasion by the agencies has been 
even more effective in continuing to drive those numbers down and 
encourage the full-file reporting. 

Chairman Shelby. Senator Sarbanes, I would like to thank you 
for your patience. 
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Senator Sarbanes. Thank you very much, Mr. Chairman. I will 
be brief. This has been an extremely helpful hearing, in my view. 
Also, I want to thank both of the witnesses who are currently at 
the table for their testimony and their statements. 

Mr. Mierzwinski, I particularly appreciate this very detailed tes- 
timony that you and the other organizations that you are rep- 
resenting have put together here. 

In that light, Mr. Chairman, I hope we can keep the hearing 
record open to receive additional recommendations. 

Chairman Shelby. We certainly will. The record will remain 
open. 

Senator Sarbanes. I wanted to ask you this question. I am par- 
ticularly interested in this. One of the ways of assuring that the 
consumer can straighten things out is that he can bring legal ac- 
tion under FCRA in order to do so. Is that correct? 

Mr. McEneney. Yes. 

Senator Sarbanes. And that is an instrument whereby you get, 
in a sense, some self-policing of the workings of the system and I 
guess in that respect is desirable. Would you both agree with that? 

Mr. McEneney. I think one of the most powerful things about 
the FCRA is the tools it gives the consumer to get out and dispute 
the information they believe is inaccurate and to have it corrected. 

Senator Sarbanes. Now, let me ask you this question: The cur- 
rent statute of limitations governing the time period by which a 
consumer must bring legal action under the FCRA runs 2 years 
after the occurrence of the fraud, regardless of when the victim dis- 
covers it. 

Now, in the most extreme case, the victim could discover it more 
than 2 years after the fraud occurred, and the statute of limitations 
would knock the victim out of the box, would it not, under current 
statute? 

Mr. McEneney. Yes, I believe it would. 

Senator Sarbanes. Well, I have difficulty understanding. Obvi- 
ously there is no fairness to that, and obviously it eliminates the 
workings of the system in terms of the consumer correcting it. 

Now, some have suggested that the statute of limitations period 
should be 2 years after the date on which the violation is discov- 
ered or should have been discovered by the exercise of reasonable 
diligence, because I can understand it will be argued, well, you 
know, they should have known this, we just cannot have this thing 
hanging out there forever. So you put some burden of responsible 
action on the consumer. 

But why wouldn’t that be a better way for the statute to work, 
2 years after the date on which the violation is discovered or 
should have been discovered by the exercise of reasonable dili- 
gence? Do you have any problem with that? 

Mr. McEneney. Senator, just a clarification of how I think that 
statute of limitations issue works. If I am a consumer and I come 
to look at my file at any time, my rights accrue at the time I look 
at that information to dispute the information and have it cor- 
rected. It is not that if the information was added more than 2 
years ago I cannot correct it. I can demand correction anytime it 
is in my file. 
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I think the situation that you may be referring to is one where 
a consumer comes to look at his or her file, believes that there is 
a problem in it, and more than 2 years ago, for example, applied 
for credit or took some other action and believes they were dam- 
aged at that point in time. Under those circumstances, I believe the 
statute would run, and the individual would not have a right to go 
back and sue for an act or for damages that took place 2 years 
prior, but would have the right to demand correction of that infor- 
mation right then and there. The 30-day time frame would then 
apply, and all their rights would accrue. 

I think that it is important to just focus on what that statute of 
limitations issue really means. The consumer always has the right 
to come and dispute what is in his or her file. 

Mr. Mierzwinski. Senator Sarbanes, if I could add, we want to 
reverse the Supreme Court in the TRW v. Andrews case. We think 
it is important to clarify the discovery rule and make it easier. The 
complexity of the discovery rule is just one example of how the gen- 
eral principle of this Act is that the consumer generally has a right 
to self-enforce his or her rights. But those rights are very difficult 
to enforce. 

In 1996, a former Member of the Committee, Senator Bryan, 
worked very hard to establish a furnisher liability compromise. As 
part of that, he said consumers could sue banks and department 
stores some of the time after they failed to comply with the reinves- 
tigation, but not if they simply provided information to a credit bu- 
reau that they consciously knew was in error. So that first test 
would only be enforceable by the agencies. The consumer could only 
sue in the latter case where there was a request by the consumer 
to remove the fraudulent or false information and that information 
was not removed. 

Consumers had to go to court for the last 8 years. They had to 
get the Federal Trade Commission to file amicus briefs on their be- 
half Despite clear legislative intent that Congress intended to give 
consumers the right to sue furnishers of information in some cir- 
cumstances, many furnishers of information argued that they did 
not have the right to sue them. The law is very difficult to enforce 
as a private individual. 

One example: Why is there so much identity theft? There is so 
much identity theft because the companies do not care about fixing 
the problem. They look at it as a cost of doing business. That is 
all it is to them. They are making so much money issuing credit 
that the millions of consumers who are victims of identity theft 
have so much trouble enforcing the law and clearing up their 
name, as Captain Harrison did, that they just give up. And we 
really need to make it easier for consumers to enforce their rights, 
strengthen the duties of these companies. 

Senator Sarbanes. I may not be fully understanding, but I have 
difficulty understanding the rationale for a statute of limitations 
that runs when the victim is unaware that something wrong has 
been done to them. I understand once they know about it if they 
then do not do anything about it within a reasonable period of 
time, or if, you know, by taking due diligence they should have 
known about it and did not do it because they were — that is a dif- 
ferent situation. But the situation in which they just do not know 
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about it and then they find out about it and they want to do some- 
thing, someone says, well, you know, 2 years has gone by, it is just 
too bad but you are out of luck. 

I mean, what is the rationale to justify that kind of position? 

Mr. McEneney. I would be happy to look into the details of the 
statute of limitations issue for you. Senator. 

Senator Sarbanes. On first blush, it is hard-put to see a ration- 
ale, isn’t it? 

Mr. McEneney. You know, statutes of limitation generally are 
designed to avoid litigation involving issues where the facts rel- 
evant to those issues took place beyond a certain period of time be- 
fore. And I would have to look at the specific issues you are talking 
about. 

Senator Sarbanes. Even if you go down that path, 2 years is a 
pretty short period of time when you are talking about, I think, 
matters of this sort. But a lot of statutes of limitations have in 
them some provision about knowledge or should have had knowl- 
edge in order for the time period to kick into effect and then knock 
you out of getting a remedy. You, after all, are the one who has 
been victimized. My question is whether the victim should be able 
to get some remedy for that, and it is quite a step simply to knock 
them out of getting any remedy when they are in complete lack of 
knowledge that this has been done to them. 

Mr. McEneney. Senator, I would be happy to look at the details 
of that issue and get back to you. 

Senator Sarbanes. Thank you, Mr. Chairman. 

Chairman Shelby. Could I ask the other side, could you also fur- 
nish information regarding the same subject? 

Mr. Mierzwinski. Mr. Chairman, we would be happy to do so. 
And we had an amicus brief before the Court in that case, which 
we will provide to the staff. We think the Supreme Court was 
wrong, but it was a statutory ruling, so the Committee can cer- 
tainly reverse them. 

Chairman Shelby. Senator Bennett. 

Senator Bennett. Thank you very much, Mr. Chairman. 

Mr. Mierzwinski, I have gone through your recommendations, 
every one of which has some rationale behind it. But taking the 
whole thing in total, it reminds me of the comment that came out 
of the Vietnam War where the infantry captain said, “In order to 
pacify the village, we had to destroy it.” 

And I think if all of these recommendations were put in place in 
order to make sure that the customer got absolute accuracy and ab- 
solute protection of his privacy, you would cut him off from the op- 
portunity of obtaining credit. And that is what this whole thing 
was about. 

Again, I go back to my first days in this Committee where the 
complaint was that particularly minorities and others who did not 
have a gilt-edged credit history were being denied credit absolutely, 
and the Fair Credit Reporting Act has gone a long way toward 
making credit available to them. And if we say, yes, but there is 
this and there is this and there is this and there is this possibility, 
every possibility of which must be guarded against, we go back to 
the bad old days when the only people who could get credit are 
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those who basically do not need it. So, I have some real problems 
with the totality of what you are presenting here. 

Now, I also disagree with you about the GAO report because I 
think the GAO report reflects what we have heard in these hear- 
ings. We have had a wide range of studies presented to us. You 
claim, with understandable enthusiasm, that the studies that sup- 
port your position are the reliable ones and the peer-reviewed ones 
and the objective ones. But other witnesses claim, with equal sin- 
cerity, that the studies that they put forward are objective and 
peer-reviewed and reliable. And the results, as we found in pre- 
vious hearings, are all over the lot. 

So it does not surprise me at all when the GAO begins with the 
quote with which the Chairman began this hearing, and I will read 
it again: “Information on the frequency, type, and cause of credit 
report errors is limited, to the point that a comprehensive assess- 
ment of overall credit report accuracy using currently available in- 
formation is not possible.” And that resonates with the sum total 
of what we have heard in these hearings. 

In the GAO report, we have what I find to be a very useful sum- 
mary as to the common causes of errors in the consumer credit re- 
port process, and they cite three common causes: 

Number one, consumers. Consumers provide inaccurate data to 
furnishers, either by mistake — which I assume is by far the most 
logical reason — or purposely provide false information in order to 
establish a new credit identity. This is a form of identity theft, if 
you will, identity concealment. I have bad credit; I will now, in an 
attempt to create a new identity for myself, mislead the furnishers. 
That is the first cause of errors. 

The second cause of errors, furnishers input accurate information 
incorrectly. I referred to this previously where I described where I 
was moving, over the phone, opening an account. My name is Rob- 
ert F. Bennett, and the bill came back Robert S. Bennett. There 
was not anything malevolent about it, but the person on the other 
end of the line heard my “F” as an “S” and I have been unable to 
correct that, as many times as I have tried. Finally, I just pay the 
bill, Robert S. Bennett every month and I do not worry about it. 
But that is accurate information incorrectly inputted. Pass on in- 
complete or inaccurate data to consumer reporting agencies, or 
pass on accurate data in incorrect format. Fail to voluntarily report 
data. Those are all of the various ways that furnishers put in accu- 
rate information into the system. 

And finally, the third way you get errors is that the bureaus 
input inaccurate information or they input accurate information in 
the incorrect file. Robert S. Bennett begins to get information that 
is not accurate because somehow he is getting my utility bill put 
in there. 

Because of these common errors involving consumers, furnishers, 
and credit reporting agencies, the GAO has concluded that we can- 
not get our arms around the size or complexity of the problem. 

So I think what we need to do, Mr. Chairman, is continue that 
which has been working, and for that reason, I am strongly in 
favor of both the preemption provision and the affiliate sharing 
provision, while we continue to try to find out more information 
about where the inaccuracies come from and what we can do to 
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deal with it. I think the reference to the bank regulators to which 
you, Mr. McEneney, have referred, is an indication the bank regu- 
lators have gotten tough and the number of inaccuracies or omis- 
sions has begun to go down. And I think that is a salutary thing, 
and we should work for that. 

I am in favor of Senator Sarbanes’ position on the statute of limi- 
tations. I cannot imagine why it would be a problem to say that, 
well, if something has gone bad, you do not know about it until 18 
months later, and then suddenly you are faced with a major iden- 
tity theft problem, you have only got 6 months to get your lawyer 
together and file the case. I want to have the full 2 years from the 
time that happens. 

Those are the kinds of changes that I think we can make. We 
can tighten things up. But I do not want to throw out the baby 
with the bath water. I do not want to reverse the fact that credit 
has been made available to a wide range of Americans who did not 
have it before in the name of saying, well, we are going to protect 
your privacy in all of these belt and suspenders and raincoat kinds 
of ways, and in the process you are going to be completely private, 
but you are not going to get any credit. 

Mr. McEneney. Senator Bennett, on the GAO finding of the in- 
ability to assess accuracy, I would just like to make one point. It 
does not answer the question, but perhaps provide some temporary 
comfort. That is, there is a proxy for assessing the accuracy of the 
information at a broad level, and that is its remarkable predictive 
value. Creditors successfully rely on this information, have been ex- 
tremely successful in making credit more widely available, more 
cheaply than ever before, and that would not be the case unless the 
information were accurate to a high degree. 

Now, that does not deal with the detailed issue, but I am just 
saying that there is some comfort to be taken from that widely 
available fact. 

Mr. Mierzwinski. If I could speak to that briefly. Senator — and, 
by the way, on your first point on our recommendations, we would 
be happy to work with you. If you want to take our top five or 
something like that, we would be pleased. 

Senator Bennett. Well, as long as you give me preemption and 
affiliate sharing, why, I would be happy — 

[Laughter.] 

Mr. Mierzwinski. But the situation here, I think — and I would 
refer you — I will provide it to the staff. There is a study by a Phila- 
delphia Federal Reserve Board economist, Mr. Hunt, that talks 
about some of the ways that information is used in the system. And 
one of the points he makes is a theory that the system is weighted 
toward false negatives; that is, the system may be providing credit 
accurately to people that deserve 

Chairman Shelby. Would you furnish a copy of that to the Com- 
mittee? 

Mr. Mierzwinski. Yes. May be providing credit in a way that 
people that deserve credit tend to get credit but some people may 
be paying too much for credit. And that is what the system is not 
measuring, and that is my point on the GAO report. I only read 
it very quickly. I just got a copy of it. But the one particular part 
of the CFA report was the study of half a million scores that I do 
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not think they looked at in as detailed a way that they should 
have. And that was my point. 

On the other studies, mayhe their points were more valid. But 
on that particular portion of the CFA report, that is where I dis- 
agree with them. I was encouraged, however, that they agree with 
our finding and recommendation that there should he more adverse 
action notices provided so more consumers trigger looking at re- 
ports and trigger reinvestigations. 

Senator Bennett. I think the Committee is clearly going in that 
direction. That is what the FTC recommended. 

Mr. Mierzwinski. Right. 

Senator Bennett. I think there is some legitimacy to that. 

Thank you, Mr. Chairman. 

Chairman Shelby. In closing, I want to thank you two for being 
patient today and also for your input. I believe this will help guide 
the Committee as we seek in the next weeks to craft a bill that bal- 
ances the interests of consumers and the needs of the credit mar- 
ket. We are not going to try, I hope, to reinvent the automobile 
here, but we believe that we can maybe change the model a little 
bit, fine-tune it and make it work better for the American people, 
and that is all of us. 

Thank you, gentlemen. 

Mr. McEneney. Thank you. 

Mr. Mierzwinski. Thank you. 

[Whereupon, at 12:40 p.m., the hearing was adjourned.] 

[Prepared statements, response to written questions, and addi- 
tional material supplied for the record follow:] 
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PREPARED STATEMENT OF SENATOR ELIZABETH DOLE 

First of all, I want to thank Chairman Shelby on behalf of the people of North 
Carolina and the entire country not only for holding today’s hearing on measures 
to enhance the operation of the Fair Credit Reporting Act, but also for holding six 
hearings on the issues involved in the reauthorization of the Fair Credit Reporting 
Act preemptions. This has given us all an opportunity to examine the great benefits 
the FCRA has brought to the consumers of America. 

These hearings have also illustrated the ways this law can be strengthened to en- 
sure more accurate credit reports and help our efforts to combat identity theft. The 
actions of the House Financial Services Committee passing its version of this legis- 
lation by an overwhelming vote of 61-3 shows there is a broad consensus on the 
issues before us and that we all can work together to accomplish our goal this year. 

While I have long spoken out about the tangible benefits the FCRA has brought 
to our Nation by lowering the cost of credit and empowering individuals, there are 
further steps we can take to help consumers and industry, such as providing access 
to a free credit report once a year. A free report will help consumers gain a better 
understanding of the factors that financial institutions take into account when pric- 
ing a product and when deciding whether to extend credit. Free credit reports will 
also ensure the accuracy of credit reports and help stop identity theft, a destructive 
crime that is unfortunately growing more common every day. 

As we all know, there has been a healthy debate on the issue of credit scores. 
While I feel strongly that consumers should be given an accurate description of the 
different factors that go into these numbers, I do not think this should extend to 
the right to a free credit score. This score is a proprietary analysis of a credit report 
used to gauge the risks involved in extending credit to an individual. Since inde- 
pendent businesses develop the scores with their own resources, they should be able 
to receive a small fee for their use. It is also my hope that we not put one score — 
such as FICO — above all others. Competition in the credit score market should be 
preserved. 

I want to thank our distinguished panel of witnesses for taking the time to join 
us here today. I look forward to working with all of my colleagues on these issues 
as the Committee prepares to craft a legislative package. 


PREPARED STATEMENT OF JOHN W. SNOW 

Secretary, U.S. Department of the Treasury 

July 31, 2003 

Thank you Chairman Shelby, Senator Sarbanes, and other distinguished Mem- 
bers of this Committee for this opportunity to testify on the Administration’s 
proposal to strengthen the use of the Fair Credit Reporting Act (FCRA) to promote 
consumer interests. 

All consumers have two important interests, the promotion of which is the central 
purpose of the FCRA. One is the interest in improved access to credit and other 
financial services. The other is the interest in the accuracy and security of their fi- 
nancial information. The Administration proposes to remove the sunsets on the uni- 
form standards and focus these standards and the FCRA even more on meeting 
these two key consumer interests. 

A hallmark of our country is readily available credit. In fact, it is not too much 
to say that ready access to credit on competitive terms is an integral part of the 
economic security and well-being of American families. All over the country, Ameri- 
cans depend on competitive credit markets to realize the dream of homeownership, 
to finance their cars, to pay for college, and meet a variety of other needs. More 
than two-thirds of Americans now own their own home, and 9 out of 10 homes are 
purchased with a mortgage. For example, consumer credit helps finance the vast 
majority of the more than 15 million cars and trucks consumers purchase annually. 

The FCRA’s uniform national standards for information sharing operate to expand 
the opportunity for consumers to access credit and financial services — they make 
your reputation as a borrower portable, so that you do not have to establish your 
good name from scratch in every city you visit, or every store where you shop. 

The Council of Economic Advisers estimates that, if States passed laws that sig- 
nificantly deviated from the national uniform standards of the Fair Credit Reporting 
Act, 280,000 home mortgage applications that are now approved each year would 
be denied — that is $22 billion in new mortgages annually. Access to accurate and 
reliable financial information is particularly important for approving loans to first- 
time homebuyers, for example. 
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This democratization of credit has especially benefited minority and lower income 
families. For example, from 1995 to 2001, the percentage of minorities holding mort- 
gages increased significantly — one-sixth of minorities who qualified for mortgages in 
2001 would not have qualified in 1995, a higher rate of improvement in homeowner- 
ship than for families overall. In addition, the percentage of minority families with 
credit cards has risen substantially. From 1995 to 2001, the percentage of African- 
American families holding credit cards rose from 39.4 percent to 55.8 percent. More 
generally, since 1970, credit access by U.S. households in the bottom half of income 
distribution has experienced the most rapid growth. National uniform standards 
help all Americans participate more fully in the miracle of modern credit markets. 
We need to accelerate that process and do nothing to slow it down. 

Perhaps the most serious threat to financial consumers today is identity theft. 
Identity thieves are clever, adaptable, and heartless. Indeed, many identity thieves 
specifically target the most vulnerable members of society — families of the recently 
deceased, seniors, hospital patients, and men and women serving our Nation over- 
seas. These schemes come in many forms and I have described several of the more 
deplorable schemes elsewhere. Today, I would like to cite still another example, as 
reported last week, that demonstrates how clever and adaptable the thieves are: 

Using a $100, commercially available keystroke logging program, an iden- 
tity thief in New York stole over 450 online banking passwords during a 
2-year period. The scam began with the thief installing a keyboard-sniffing 
program on public Internet terminals at 13 locations scattered throughout 
Manhattan. Unwitting customers using the terminals then had their key- 
strokes logged as they accessed information. With username and password 
information in hand, the thief used the victims’ personal and financial in- 
formation to open new accounts under their names and transferred money 
from the victims’ legitimate accounts into the new, fraudulent ones. 

Many Americans have worked hard for years to build and keep good credit his- 
tories. In today’s information-driven economy, one of your most important personal 
assets is your reputation, your credit history. The statistics are there — and have 
been cited by many. For example, a recent study reports that identity theft has been 
seriously under-reported and asserts that 7 million Americans were victims of iden- 
tity theft last year alone. We may never know what the right number is. But one 
thing we do know is that there are far too many victims of identity theft and that 
the crime is spreading. 

One of the most distressing aspects of identity theft is how quickly an identity 
thief can damage your credit history and how long it can take to undo the damage. 
A recent General Accounting Office study found that victims spend on average 175 
hours tr 3 dng to recover from the crime. In many cases, recovery can take even 
longer, and involve thousands of dollars in legal and other expenses. The costs are 
so significant that a market in identity theft insurance is now developing. 

Our national information sharing system can and should be improved to do more 
in the fight against identity theft. As we do so, it is important to understand that 
national standards for sharing such information are an important tool in the fight 
against identity theft. When a thief tries to steal your identity and open an account 
in your name, he is posing as you, hiding behind a mask that he has constructed 
out of bits of information about your identity. Bankers or merchants can stop the 
would-be thief right in the act, before the crime is committed, if they have timely 
access to the right information. With the right information about your true identity, 
financial institutions can ask validating questions and peer behind the thief’s mask. 
In other words, your banker can stop the identity thief if your banker is more famil- 
iar with you than the thief is. National uniform standards make timely access to 
full and accurate information possible, giving financial institutions the tools to stop 
many identity theft assaults before they can succeed, information moving faster 
than the thieves. 

On June 30, I announced the Administration’s proposals to make the Fair Credit 
Reporting Act an even more effective instrument to protect consumer financial data 
from fraud and abuse, enhancing the quality and integrity of that information, while 
at the same time expanding consumer access to credit and other financial services. 

We are extremely pleased that several of these proposals are contained in bipar- 
tisan legislation now pending before the House of Representatives, approved last 
week by the Financial Services Committee by a strong 61 to 3 vote. We look forward 
to working with you as the Senate considers these issues. In my testimony today, 
I wish to focus on five of our proposals: 

• Free credit reports upon request. To achieve these important goals of the Fair 

Credit Reporting Act we would be wise to engage the consumers themselves. A 

basic tool to place in the hands of consumers is access to their credit reports, once 
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a year, upon request, free of charge. Consumers should be offered the opportunity 
to review their credit reports for accuracy and completeness. We believe that this 
proposal will not only help stop identity theft, but that it will also lead to im- 
provement in the overall quality of the information in the credit reporting system. 
After all, no one has a stronger interest in ensuring the accuracy of their credit 
reports than consumers themselves. As the overall quality of the information im- 
proves, everyone will benefit — consumers, merchants, financial institutions, and 
the economy as a whole. 

• National Security Alert System. We recommend that the uniform standards in- 
clude a national security alert system. Under such a system, consumers who have 
been victimized or are in danger of being victimized can put banks and merchants 
on their guard against any further efforts to impersonate the consumer, thus 
making it much harder to steal one’s identity. 

• Red Flags. We propose the bank regulators also be put on the watch for patterns 
followed by identity thieves, red flags that indicate the likelihood of fraudulent 
activity. The regulators would provide notice of these red flags to the institutions 
that they supervise and put them on the watch for these telltale signs. Further, 
the regulators would verify in their bank examinations that these warning signs 
are being heeded, fining those institutions where lack of attention results in cus- 
tomer losses. I regard this proposal to be a very important part of the package. 
One of the challenges in fighting identity theft is that identity thieves are adapt- 
able. They are always looking for ways to exploit systems and procedures that we 
set up to thwart them. It is important, therefore, that regulators and financial in- 
stitutions be equally adept in catching them. To be effective and not become soon 
out of date, this proposal avoids locking today’s tell-tale signs in the statute, but 
instead gives regulators the flexibility to adapt to new identity theft schemes and 
to establish procedures to thwart them and foil the efforts of the would-be thieves, 
and it gives financial institutions increased incentives to be on guard as well. 

• Prohibition on the sale or transfer of identity theft debt. Another important Admin- 
istration proposal is a prohibition on the sale or transfer of debt for collection a 
creditor knows is the result of identity theft. Too often, consumers labor for hours 
persuading a creditor that they were the victims of identity theft only to find that 
they must begin the process all over again with a new creditor who has purchased 
the debt from the original creditor. Our proposal would help reduce repollution 
of consumer’s credit files and save consumers countless hours of needless hassle. 

• Adverse Action Notices. The Administration proposes granting the FTC specific 
rulemaking authority that would require notices to consumers when their credit 
scores caused them to be offered less favorable rates than for which they applied. 

These are a few highlights of the package of proposals we have offered, that would 
build upon and amplify the use of the FCRA to promote consumer access to credit 
within a context of improved accuracy and security of personal financial informa- 
tion. Enactment of this package will make our national information sharing system 
even more a servant of consumer interests. 

Given the important role that the national standards of the Fair Credit Reporting 
Act play in expanding access to credit and maintaining the accuracy and security 
of consumers’ information, it should come as no surprise that national information 
sharing standards benefit our economy as a whole. It seems so basic that we take 
it for granted, but an integral part of our economy’s success is our confidence in fi- 
nancial services such as bank services, insurance, and investment products. Our 
credit markets helped the American economy weather the serious shocks we have 
experienced over the last 3 years — a recession, September 11, homeland security, 
corporate accounting fraud, and so on. 

And there should be no doubt that the national uniform standards of the Fair 
Credit Reporting Act help make our credit market more robust. According to the 
Council of Economic Advisors, if the national standards were to expire, and States 
adopted new laws currently under consideration, a minimum of 3.5 percent of loans 
currently approved would be denied to maintain the same level of credit risk. This 
could put as much as $270 billion of consumer credit in jeopardy. 

We look forward to working with this Committee and the full Senate to move a 
strong package of reforms into law this year and ensure that the Fair Credit Report- 
ing Act becomes an even more effective tool for meeting the financial interests of 
American consumers. Accomplishing this task is vital to the future of our economy. 
With improved national standards, we can make great strides to protect our citizens 
against identity theft, while holding open the doors of credit to many more Amer- 
ican families of every income and background. 
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PREPARED STATEMENT OF MICHAEL F. McENENEY 

Partner, Sidley Austin Brown & Wood LLP 
ON BEHALF OF THE U.S. CHAMBER OF COMMERCE 

July 31, 2003 

Good morning, Mr. Chairman, Senator Sarbanes, and Members of the Committee. 
My name is Michael F. McEneney and I am a Partner at the law firm of Sidley 
Austin Brown & Wood LLP. I am pleased to have the opportunity to appear before 
you today on behalf of the U.S. Chamber of Commerce. The U.S. Chamber serves 
as the principal voice of the American business community here in the United 
States and around the world. Specifically, the Chamber is the world’s largest busi- 
ness federation, representing more than three million businesses of every size, sec- 
tor, and region of the country. 

The FCRA has provided a robust framework for the most advanced consumer 
credit and insurance markets in the world. A key component of this success is the 
fact that the FCRA establishes a single national system in which our credit and in- 
surance markets can operate smoothly. This has resulted in significant consumer 
benefits, in the form of increased credit and insurance availability at lower costs, 
and has provided a source of strength for our economy. The national uniformity of 
key provisions in the FCRA is currently scheduled to expire on January 1, 2004. 
Making these provisions permanent has been a high priority for the Chamber and 
the business community generally. We urge the Members of the Committee to make 
these provisions permanent. 

The Economic Importance of National Uniformity 

At the beginning of the Committee’s deliberations on these issues, there were a 
number of questions raised about the significance of the national uniformity estab- 
lished by the FCRA. A recent study entitled “The Fair Credit Reporting Act: Access, 
Efficiency, and Opportunity” goes a long way to answering those questions. The 
study was prepared by the Information Policy Institute (IPI) with the support of the 
National Chamber Foundation of the U.S. Chamber of Commerce. The aim of the 
study was to examine specifically whether a loss of the existing framework of pre- 
emption would threaten the benefits of our credit markets currently enjoyed by con- 
sumers. This study relied on hard data to determine the impact on consumers and 
industry if the national uniform standards were lost. I would like to share some of 
the study’s findings with the Committee. 

In General 

In all areas of inquiry, the IPI found that the national uniform standards estab- 
lished by the FCRA have contributed significantly to the consumer benefits of the 
current credit marketplace. Further, the IPI found few quantifiable direct or indirect 
costs to consumers associated with the national uniform standards. The study con- 
cluded that the loss of the existing framework of preemptions would threaten the 
current consumer benefits, and that Congressional action is necessary to ensure the 
continuity of our national standards. 

Mortgages 

The study recognizes that many of the efficiencies developed by the mortgage un- 
derwriting market, such as automated underwriting, are made possible, at least in 
part, by the national uniformity established by the FCRA. According to the study, 
automated underwriting consistently does a better job of identifying loans that ulti- 
mately “perform” — loans that do not experience a serious delinquency or default. 
Moreover, automated underwriting allows mortgage underwriters to accommodate 
high volumes of activity. For example, in 2002, the Federal Reserve estimates that 
homeowners were able to gain access to approximately $700 billion of equity in their 
homes — an astounding figure that may not have been possible under a less efficient 
system. The introduction of mortgage underwriting efficiencies, which have resulted 
in part from the national uniformity established by the FCRA, also appear to have 
significantly reduced the costs of closing a loan, saving consumers at least $18.75 
billion in 2002. 

Credit Availability 

The study also examined four different scenarios under which the FCRA’s na- 
tional uniformity was allowed to expire and the FCRA’s operative provisions were 
modified in ways suggested by existing legislative proposals in various States. The 
study examined the impact of these changes on six different commercial credit scor- 
ing models in order to approximate the impact on consumers and the cost of credit. 
In all four scenarios, the study found that loan approval rates would decrease or 
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delinquencies would increase, resulting in increased costs to consumers. Further- 
more, the predictive power of credit report information would decline, damaging 
creditors’ ability to evaluate credit risk. If creditors cannot properly evaluate credit 
risk, one of two things generally occurs in order to hedge against that increased 
risk — creditors make less credit available, or they increase the cost of credit. Either 
way, consumers lose if the FCRA’s national uniform standards expire. 

Prescreening 

The study evaluated the current practice of “prescreening” customers for 
preapproved offers of credit. According to the study, increased competition which 
bas been driven in part by prescreening, has caused interest rates to he lower over- 
all than they were in 1990. The study also found that prescreening was the most 
important method of acquiring new credit card customers, and that restrictions on 
prescreening would increase costs to consumers, and decrease consumers’ access to 
unsecured credit. 

The Importance of National Uniformity to the Security of Consumers’ 
Personal Information 

The Chamber believes that it is important to pursue the goals of providing for 
continued access to credit as well as protecting the security of consumers’ personal 
information. The national standards established by the FCRA are an important 
component of protecting the security of consumers’ personal information. For exam- 
ple, the national uniform provisions under the FCRA ensure that financial institu- 
tions can have access to reliable credit report information for a variety of purposes, 
including identity theft prevention. Indeed, the important role credit reports can 
play in the efforts of financial institutions to verify the identity of their customers 
bas been recognized as part of the regulatory efforts to implement the customer 
identification provisions of the USA PATRIOT Act. 

The national uniform standards also allow companies to prevent identity theft in 
other ways. Under the FCRA, companies have a single Federal standard governing 
their ability to share information among affiliated entities. A key purpose for the 
sharing of information among affiliates is to prevent fraud, including identity theft. 
The FCRA also establishes a uniform standard for prescreening consumers for cred- 
it. It is noteworthy that the fraud rates, including identity theft, are significantly 
lower on accounts acquired through prescreening than accounts acquired through 
other means. Providing States the opportunity to enact their own prescreening rules 
would make this more secure method of customer acquisition less attractive if not 
impossible. 

The national standards established by the FCRA also ensure that consumers have 
the tools necessary to protect themselves against identity theft. For example, con- 
sumers are provided a standardized notice if they are the subject of adverse action 
based on a consumer report. This notice, which is uniform across the country, in- 
forms the consumer of the adverse action and notifies the consumer that the action 
was based, at least in part, on information from a credit report. This is a “red flag” 
to the consumer to check the credit report to ensure its accuracy. Furthermore, the 
FCRA establishes a single timeframe under which credit bureaus have to reinves- 
tigate any consumer disputes. I think we can all agree that it is challenging enough 
for credit bureaus and consumers to resolve identity theft issues under a single set 
of rules — imagine the difficulty if credit bureaus had to comply with different rules 
depending on where the consumer is located. 

The Practical Application of the FCRA to Underwriting 

Although the broad concepts I have discussed to this point are important, I would 
like to provide a more practical application of how the credit reporting and under- 
writing process thrive under the FCRA. The concept of credit underwriting, or the 
analysis of economic risk on which a decision to lend money is based, has received 
repeated mention by many participants in the debate, but at no point bave we really 
stopped to talk about what that means. I have attached an example to my testimony 
consisting of two simple revolving loan portfolios, each containing 100 loans of 
$1,000 apiece, and each paid off within a year. One portfolio has an interest rate 
of 5 percent, the other a rate of 18 percent. 

If one loan in the 5 percent portfolio were to immediately default (whether be- 
cause of identity theft, consumer bankruptcy, or poor judgment on the part of the 
lender), it would take the interest payments from 41 performing loans to com- 
pensate for that default. If, instead, as few as three borrowers default, the lender 
is completely underwater — and will lose money — even before facing the expense of 
managing 97 other loans. If one loan in the 18 percent portfolio defaults, it takes 
the interest from 12.11 performing loans to compensate for that one default. Even 
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if the lender gets it exactly right 92 percent of the time, no matter how well those 
92 consumers pay their bills, the lender is in serious trouble. 

There is not much more to underwriting than that. And this is why it is so impor- 
tant for lenders to be able to assess credit risk accurately. The complicated part oc- 
curs when trying to fit the maximum number of borrowers into the continuum of 
rates between 5 and 18 percent while keeping defaults to a minimum. Whoever does 
the best job of fitting borrowers to a particular interest rate attracts the most cus- 
tomers because they can offer the lowest rate and manage their defaults so they still 
make money. Anything that enhances this process has obvious consumer benefits. 
Since 1996, the seven preemptions of the FCRA have enabled lenders, at a national 
level, to take advantage of technological advances to serve their customers while 
greatly refining their ability to fit the right borrower into the right rate. 

Potential Issues for Enhancement 

Identity Theft 

One issue that deserves serious consideration is identity theft. Although identity 
theft is not caused by the FCRA, we believe the FCRA can certainly provide part 
of the solution. In general, we believe that there is a common theme that should 
guide the Committee in its consideration of provisions to combat identity theft. More 
specifically, the Chamber believes that the methods used to address potential iden- 
tity theft scenarios should be flexible, allowing companies to utilize the means most 
efficient to them to thwart identity thieves. Indeed, a “one-size-fits-all” approach 
may not work — the challenges presented by identity thieves will invariably change 
over time and the tools used to combat the thieves should change as well. 

The Chamber is concerned that if the methods for preventing identity theft are 
“written in stone,” companies will be forced to devote resources to complying with 
these methods, regardless of whether they become outdated or if more efficient 
alternatives become available. Furthermore, if companies must adhere to specific 
statutory requirements with respect to identity theft, it may become very difficult 
for companies to alter their procedures in light of the constantly evolving nature of 
identity theft schemes. 

Access to Credit Reports 

It is important for a consumer to have access to his or her credit report in order 
to ensure the report’s accuracy, as well as to address any instance of identity theft 
as soon as possible. The FCRA currently ensures that access to credit reports is rel- 
atively inexpensive — the cost is capped by law at $9. In addition, the Chamber 
strongly supports the provisions in current law that provide consumers with access 
to their credit report at no charge in certain situations. For example, a consumer 
can obtain his or her credit report for free if the consumer: (i) has been the subject 
of “adverse action” (for example, denial of credit) due in part to information in a 
credit report; (ii) is unemployed and intends to apply for employment; (hi) is a re- 
cipient of public welfare assistance; or (iv) has reason to believe that the file on the 
consumer at the credit bureau contains inaccurate information due to fraud, includ- 
ing identity theft. 

Aside from the numerous instances when a consumer currently can obtain a copy 
of a credit report for free, some have advocated providing consumers with a credit 
report at least once annually at no charge. The Chamber welcomes the consideration 
of how to make credit reports more available to consumers. We believe, however, 
that this issue merits careful study before next steps are taken. In particular, there 
should be a careful examination of the costs associated with a “free” credit report 
in order to ensure that there are no unintended consequences. For example, the 
costs of providing free reports and the related customer service will have to be ab- 
sorbed by the consumer. Moreover, resources that are currently dedicated to inves- 
tigating potential errors in consumer reports, or assisting consumers with resolving 
identity theft claims, will need to be redirected to meet the demand for “free” credit 
reports. It should also be noted that a single, well-placed national news article or 
widely circulated e-mail could create significant spikes in demand for credit reports 
that simply could not be met without severe disruption to the other important cus- 
tomer service functions performed by credit bureaus. 

Investigating Wrongdoing in the Workplace 

Currently, the broad definitions of “consumer report” and “consumer reporting 
agency,” as interpreted by the FTC, appear to apply if an employer uses outside ex- 
perts to investigate employee misconduct. This results in the outside firm, such as 
an accounting firm or law firm, potentially becoming a consumer reporting agency 
for purposes of the FCRA. Because of the difficulties in conducting an investigation 
while complying with the FCRA’s requirements, and because employers and inves- 
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tigators face significant potential liability, including punitive damages, for failure to 
comply with the FCRA’s requirements, the FTC’s interpretation deters employers 
from using experienced and objective outside organizations to investigate workplace 
misconduct. While the FTC’s interpretation affects all businesses, it is particularly 
damaging to small and medium businesses that do not have in-house resources to 
conduct their own investigations. 

The Chamber strongly believes that Congress should take this opportunity to rem- 
edy this problem. We urge the Committee to adopt legislation that would exclude 
employment investigations which are not for the purpose of investigating the em- 
ployees’ creditworthiness from the FCRA requirements. Such legislation has been 
introduced on the House side in the past few Congresses by Representatives Pete 
Sessions and Sheila Jackson-Lee and was included as Title VI of the Fair and Accu- 
rate Credit Transactions Act of 2003, which was approved by the House Financial 
Services Committee on July 24. I want to stress that the Sessions/Jackson-Lee lan- 
guage in the FACT Act is a narrow correction of an obvious problem created by cur- 
rent interpretation of the law. In addition, the legislation should not leave those 
suspected of misconduct without protection — it still requires that employers who 
take adverse action against an employee based on information from an investigation 
provide the employee with a summary of the nature and substance of the report. 
We urge the Senate to address the problem created by the FTC’s interpretation by 
enacting the Sessions/Jackson-Lee language. 

Conclusion 

Once again, I would like to thank the Committee for its efforts in examining ways 
to maintain the consumer benefits of our current financial marketplace while also 
protecting the security of consumers’ personal information. The Chamber strongly 
endorses the criteria suggested by Treasury Secretary Snow that any amendments 
to the FCRA affecting the credit reporting or credit underwriting process should en- 
hance both personal data security and access to and availability of credit. Our rec- 
ommendations are made with this formulation in mind. The Chamber looks forward 
to working with you, Mr. Chairman, and with other Members of the Committee as 
your efforts to amend the FCRA progress. 

Thank you again for the opportunity to appear before you today. I would be happy 
to answer any questions you may have. 
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Chairman Shelby, Senator Sarbanes, members of the committee, my name is Edmund 
Mierzwinski and 1 am Consumer Program Director for the U.S. Public Interest Research Group. 
My testimony today is also on behalf of a number of consumer, privacy and community groups 
including ACORN, Center For Community Change, Consumer Action, Consumer Federation Of 
America, Consumers Union, Electronic Privacy Information Center, Identity Theft Resource 
Center, Privacy Rights Clearinghouse, Privacy Times and the low-income clients of the National 
Consumer Law Center. 

Our organizations have all been active on Fair Credit Reporting Act (FCRA) matters for many 
years, have participated in the debate leading to the 1996 amendments and have published 
numerous reports and manuals on credit reporting issues. 

At the outset, we want to commend the committee for holding a comprehensive set of hearings 
on the Fair Credit Reporting Act (FCRA). The committee has developed a detailed record on 
issues ranging from identity theft and credit report accuracy to the uses of information by 
affiliates. We are pleased that the Senate Banking Committee has elected to consider our 
recommendations for refonn before preparing its own FCRA reform bill for consideration. 

The above-mentioned groups believe that a careful review of that hearing record would show 
that broad, comprehensive reforms are necessary to guarantee that credit reports and credit scores 
are accurate, that the privacy of consumers is maintained and that identity theft is stopped. We 
also believe that the industry witnesses seeking extension of the 1996 preemption amendments to 
the FCRA have failed to make their case that state authority to regulate these areas of the FCRA 
should be taken away, let alone taken away permanently. 

The House Committee on Financial Services has already approved a bill, HR 2622, that takes 
some steps to prevent identity theft and protect privacy but fails to adequately address all the 
problems identified in its own comprehensive hearings. Yet, the House committee has also 
chosen to permanently extend the temporary preemption provisions of the 1996 FCRA 
amendments. Because that bill’s reforms, taken together, are modest compared to its sweeping 
diminution of state authority, we cannot support it. 

The House bill, HR 2622, helps identity theft victims after they become victims, but its 
provisions to prevent identity theft are modest. Its intent as introduced to provide free credit 
reports including credit scores was laudable, but in committee action industry-sought 
amendments to both allow a charge for credit scores and also limit the free credit report on 
request requirement to “national” credit bureaus severely reduced the provision’s benefit. HR 
2622’s slight improvements to furnisher liability standards ignore the problem of incomplete 
reporting by creditors that results in lower credit scores. HR 2622 also fails to give consumers 
the tools necessary to clear up mistakes on their credit reports. Despite a detailed record 
demonstrating the need to significantly improve the law, the proposed bill instead defers many 
actions until proposed studies by various agencies are completed,' 


The House failed to address the growing gap in FCRA protection posed by growing use of 
affiliate-shared information for decision-making, outside the protections of the FCRA. Last 
month, in this room, Citigroup stated that it: “is able to use the credit information and transaction 
histories that we collect from affiliates to create internal credit scores and models that help 
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determine a customer’s eligibility for credit?” Despite House knowledge of Citigroup’s 
statement before this committee that it uses affiliate-shared information to assist in credit 
decision-making, the House took no action to more strictly regulate affiliate sharing, nor to 
provide consumers greater adverse action and dispute rights when their confidential customer 
records are used to profile them or make credit decisions. 

The record of both committees has also demonstrated that nearly every reform considered or 
included in HR 2622 is based on previous state actions. So, it is troubling that the combination 
of the House bill’s modest protections with its permanent extension of preemption means that 
states will no longer be able to solve many credit reporting and privacy problems. The impact of 
permanently eliminating that state authority to irmovate and respond to local problems and 
conditions should be carefully considered. 

In addition, these problems may be exacerbated if it is in fact the House’s intent, by inserting 
many of its modest reforms into sections of the FCRA already covered by the preemption 
language in 1996, to expand the preemption provisions of 1996. 

On preemption, if it was not going to sunset the provisions, as we recommend, the House 
committee should have done the following: 

(1) Reiterated Congress’s prior intention that the FCRA does not prevent states from 
exercising the right conferred on them by Gramm-Leach-Bliley to regulate information sharing, 
including information sharing among affiliates; 

(2) Only extended preemption until the proposed studies are completed and then 
provided a new sunset date, for example, two or at most four years from now; and 

(3) Confirmed that is not Congressional intent that the modest identity theft and other 
improvements to the FCRA in HR 2622 would preempt past or future state action in these areas. 

Providing for a preemption sunset would make more sense than permanent preemption since the 
Congress could once again have a robust and healthy review of the rapidly-changing 
technologies and uses of information and other important matters the two committees have been 
debating. Without the trigger of a preemption sunset, it is doubtful that the Congress will again 
overcome the legislative inertia necessary to review the FCRA in the future. 

As to the need for a grandfather clause clarification on identity theft laws, for example, we offer 
the following: California law implementing a credit card number truncation requirement that 
takes effect I January 2004. If any final Congressional legislation includes the House credit card 
truncation provision with its 2007 compliance date, are California and other earher timetable 
laws preempted? These types of troubling problems have not been addressed in any House 
debate or legislative history. 


In addition, as the testimony of U.S. PIRG’ and the Vermont Attorney General’s Office^ 
described in June, a clear reading of legislative history shows that the 1996 preemption of the 
definition of affiliate-sharing was intended to be construed narrowly to prevent companies 
sharing information from being treated as credit bureaus.^ 

Unfortunately, reiterating this prior intent is even more necessary because this week a U.S. 
district judge partly overturned local financial privacy ordinances in several California cities.'’ 
The court argued that the FCRA’s preemption provision was controlling, despite the clear 
legislative history of the Sarbanes amendment to the Gramm-Leach-Bliley Act granting states 
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the authority to enact stronger financial privacy laws. If upheld, this decision will have a chilling 
effect on the right of states to protect their citizens from privacy invasions. As the Vermont 
Attorney General’s Office testimony described above details, the decision, if allowed to stand, 
could also have a devastating impact on state efforts to regulate the insurance industry’s sharing 
of medical information. 

While we intend to work with House consumer and privacy champions to ameliorate HR 2622 
on the House floor, we believe that the Senate Banking Committee process offers consumers the 
best hope for improvements to the law. In addition to our recommendations on preemption 
above, we urge the committee to take a variety of actions detailed in an appendix to this 
testimony. Here are the highlights: 

Give consumers more information. When a consumer is denied credit on the basis of a credit 
report, give him or her the right to automatically obtain from that lender a copy of the subscriber 
report and score used to deny credit. Employment applicants already have a similar right under 
the FCRA. This provision, coupled with the annual free credit report on request, and deletion of 
the House provision allowing a charge for companion credit scores, will be a powerful incentive 
to improve accuracy. As the Federal Trade Commission has recommended, give consumers 
adverse action notices when tliey accept counter-offers for credit at a higher price. We also 
recommend that consumers be given adverse action notices - and FCRA review and dispute 
rights - when information is used in the new affiliate-sharing and decision-making world 
described in Citigroup’s testimony before this committee last month. 

Give consumers better private enforcement rights and strengthen agency enforcement. 

• Give consumers the right to go to a court and seek injunctive relief to stop a credit bureau 
from selling faulty credit reports about them. 

• Give consumers the right to seek minimum statutory damages of $ 1 00-$ 1 ,000 per 
violation of the FCRA, as other consumer laws provide, so that they don’t have to prove 
their actual damages to a court. This provision is especially critical for identity theft 
victims, who often spend hundreds of hours over a period of years trying to clear their 
good names. While the cost of emotional distress is significantly greater than $100- 
$1000, the threat of specific damages would be a powerful incentive to force creditors 
and credit bureaus to clean up the credit reporting system’s accuracy. 

• Require the major credit bureaus to provide the FTC and state Attorneys General with 
detailed annual reports on the accuracy and privacy of their databases, including 
information on their testing of the veracity of their record-keeping, statistical information 
on the completeness and accuracy of the information provided by furnishers (creditors) 
and information about the number of and disposition of consumer complaints. Require 
the FTC to publish a summary of these records to the public that is adequate to assist the 
development of public policy and to help consumers make choices about which credit 
report to request, while of course maintaining the sanctity of reasonable and legitimate 
trade secret information. 

The remainder of our testimony will discuss in detail the problems identified in the Senate 
hearings. While we use HR 2622’s positive and negative provisions as a starting off point, we 
urge the committee to paint with a fresh brush and create a better bill. At the end of this 
testimony, we provide a comparison of HR 2622’s modest provisions concerning accuracy, 
privacy and identity theft with those provisions necessary to fix the FCRA. 
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1) Any Reform Bill Must Guarantee The Accuracy of Credit Reports And Prevent Identity 
Theft 


A) During the hearings the committee heard detailed testimony about the factors 
that cause credit report inaccuracies. 

Some of the mistakes on consumer reports are the result of mis-merged file infonnation, when 
the bureau simply adds one consumer’s account to another’s file. Other mistakes result from 
fraudulent accounts of identity thieves being mistakenly added to an innocent consumer’s report. 
Still others result from coding or reporting errors where a consumer’s on-time payments are 
falsely listed as late. Surprisingly, some of the “errors” are intentional, where a creditor seeks to 
deflate its own consumers’ credit scores. 

In particular, the committee reviewed the findings of a study of the credit files of 500,000 
consumers, the most comprehensive study’ of credit reports ever completed. That study, 
produced jointly by the Consumer Federation of America, along with the National Credit 
Reporting Association®, found that 29% of consumers had discrepancies in their credit reports 
obtained from each of the three national repositories resulting in a variance of 50 points or more 
in their credit scores. Another key finding of this study, using a conservative analysis, was that at 
least 8 million Americans would likely be mis-categorized as sub-prime and pay tens of 
thousands of dollars in excess interest payments over the 30-year life of a mortgage. 

I would also like to reference into the hearing record House testimony and recent detailed reports 
from civil rights groups, including the Center for Community Change,’ NAACP Washington 
Bureau,” the National Urban League Institute for Opportunity and Equality" and the National 
Fair Housing Alliance,” that credit scoring models be made more transparent and subject to 
independent verification both to ensure accuracy and to demonstrate that the scoring models do 
not result in a disparate racial impact among protected classes and comply fully with the nation’s 
fair lending laws. See also, for example, the detailed 2002 report “Risk or Race?” by the Center 
for Community Change, which finds that “African-Americans and Hispanics are 
disproportionately represented in tlie sub-prime home refinance mortgage market” and supports 
the position that these disparities cannot be attributed solely to risk.'® 

Similarly, the committee heard in the testimony” of U.S. PIRG and CFA that a growing number 
of credit card companies are “risk re-pricing” their existing customers, often on a monthly basis 
and raising the interest rates of some consumers to as much as 25% APR, solely on the basis of 
either a reduced credit score or an alleged late payment to a different creditor. Errors in credit 
reports or defects in credit scoring models could easily affect such a harsh decision-making tool, 
as the New York Times pointed out in a Page One story.” 

In addition, the testimony of both CFA and the U.S. Public Interest Research Group has 
described how some of the nation’s largest credit card companies are intentionally failing to 
report complete information on their customers in an effort to “game” the credit scoring models, 
thereby deflating their customers’ credit scores. This anti-competitive behavior has been a 
subject of regulatory scrutiny, as documented in the record testimony. Further, following one of 
these revelations, the American Banker newspaper obtained information from Capital One that it 
continues in these practices.” These shocking and unethical practices were elaborated on in 
detail during questioning by Senators at Tuesday’s hearing. 



639 


Further, testimony before the committee regarding recent research conducted by the Federal 
Reserve Board provided confirmation of the consumer groups’ major findings that credit reports 
are inaccurate and that creditors (“furnishers of information” in the FCRA) were intentionally 
withholding full infomiation about their customem.'^ 

B) The Committee Heard Testimony That The 1996 Amendments Intended to Make 
It Easier For Victims Of Errors and Identity Theft To Clear These Mistakes Haven’t 
Worked 

Then, the committee heard detailed testimony from the Identity Theft Resource Center’* on 
behalf of identity theft victims describing the difficulties consumers face when they try to resolve 
these errors in their credit reports. The ITRC and the victims, as well as U.S. PIRG and CFA, 
provided detailed proposals to make it easier for consumers to correct mistakes and to enforce 
the law when mistakes were not corrected. 

The direct testimony of Captain John Harrison” (U.S. Army, ret.) was especially compelling as 
he documented in this room tliat he simply could not convince the credit bureaus to remove 61 
separate and obviously fraudulent accounts from his credit report and that the emotional impact 
of the problem had affected his ability to hold a job. Mr. Chairman, only one creditor reached out 
to try to help him. That is unacceptable. 

A widely cited survey, Nowhere To Turn"”, by California PIRG and the Privacy Rights 
Clearinghouse documented in 2000 that identify theft victims who contacted our organizations 
had spent an average of $808 out-of-pocket and 175 hours over a period 
of two years or more trying to clear their names of an average of $1 7,000 in fraudulent accounts. 

Recent data show that the problem of identity theft is getting worse, not better. 

• First, the FTC has documented in testimony before the committee that identity theft was the 
leading complaint to the commission in each of the years 2000, 2001 and 2002 and that 
complaints virtually doubly in 2002. 

• Second, a study released just yesterday by Alan Westin, author of the seminal 1967 book 
Privacy and Freedom, and director of the 1975-76 U.S. Privacy Commission, foimd that 
“33.4 million Americans say they have been victims of identity theft or fraud since 1990, 
with over 13 million since January 2001 and rising.” Westin projects that annual costs of 
identity theft to consumers average $1.5 billion dollars per year since January 2001.^’ 

• Third, unpublished research by the Identify Theft Resource Center being conducted as a 
followup to the report “Nowhere To Turn,” will show that it now takes victims even longer 
and costs them even more to clear up even more fraudulent accounts.^^ 

As a coda to the detailed record documenting the difficulties consumers face clearing their 
names, the committee heard detailed testimony from Mr. David Jokinen, a businessman- 
professor-consumer who has been declared dead, not once but several times, by the credit 
bureaus, and of his unfortunate adventures involved in clearing his name: “I will share with you 
my 2-year nightmare of being declared a “dead man walking.” It’s a little harder to get credit 
when the [Repositories report you as “deceased.^*” 
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All humor aside, the witness documented that the bureau errors had cost him thousands of 
dollars in excess costs and delayed loans. 

At the end of this testimony, we provide a comparison of HR 2622’s modest provisions 
concerning accuracy, privacy and identity theft with those provisions necessary to fix the FCRA. 

3) Any Reform Bill Must Guarantee Privacy 

The House and Senate committees heard record testimony about a number of other privacy 
problems. 

A) Affiliate Sharing 

First, testimony by U.S. PIRG, the Vermont Attorney General’s Office and Fordham Law 
Professor ,loel Reidenberg^'* described how the 1 996 FCRA exempts affiliate sharing only from 
the definition of credit report and also preempts states from amending that provision only as it 
applies to making those communications into consumer (credit) reports.^^ 

California and its cities continue to seek stronger financial privacy laws. Although a state 
legislative proposal, SB 1 , offered by State Senator Jackie Speier, has not passed, several local 
ordinances have been enacted. Unfortunately, a district judge overturned similar local financial 
privacy rules in San Mateo and Daly City yesterday following a court challenge from Bank of 
America and Wells Fargo, backed by the Comptroller of the Currency (OCC). 

The banks were granted partial summary judgment on their claim that the FCRA preempted state 
or local action regulating affiliate sharing, although the provisions of the ordinances dealing with 
third party sharing were upheld. We expect and will support the cities’ appeal. Yet we also 
expect the banks to appeal, making a National Bank Act claim that even the third-party sharing is 
preempted. We believe it is now appropriate for the Congress to consider a narrow amendment to 
FCRA reiterating the 1996 Congressional intent to construe the preemptive effect of the 1996 
FCRA amendment narrowly and to also make it clear that the Sarbanes amendment to the 1999 
Gramm-Leach-Bliley Act is the paramount federal rule on financial privacy, all other laws 
(FCRA, NBA and any others) notwithstanding. 

Your action is especially critical because several California organizations including Consumers 
Union, Consumer Action, AARP, CALPIRG and the Consumer Federation of California seek to 
qualify a March 2004 ballot initiative, after the proposed expiration of FCRA preemption, 
requiring opt-in consent before affiliate sharing for secondary purposes. 

The affiliate sharing exception has another flaw. It also allows detailed experience and 
transaction information to be shared and used for adverse actions without triggering the FCRA’s 
consumer protection rights,^® in the circumstance where the information is shared among 
corporate affiliates. Experience and transaction information could include details from credit 
card and checking account purchases, mortgage balances and payment histories, bank account 
and brokerage balances and other deposit account usage information and relationships with co- 
signers, if any. 

As the FTC, in an official position paper released in 1994 before the 1 996 amendments,^^ stated 
on affiliate sharing: 
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“Because the subjeet of information sharing with affiliates has not been the subjeet of 
Congressional hearings, the factual basis for the provision is not necessarily available and 
the Commission cannot easily evaluate its pros-and-cons. The Commission believes, 
however, that caution is the best approach in considering whether to create what may 
become a significant exception to the consumer protections provided by the FCRA. It 
may be preferable to defer creation of any exceptions to the FCRA’s protections for 
affiliate sharing until Congress has an opportunity to study this issue and its implications 
more carefully,” 

Unfortunately, Congress did not actually build a hearing record on affiliate sharing before it 
created this controversial loophole in 1996, It now appears that the FTC’s concern that a 
“significant exception” to FCRA’s protections would be created was correct. 

In testimony on June 26 * before this committee, Citigroup stated that it: “is able to use the credit 
information and transaction histories that we collect from affiliates to create internal credit scores 
and models that help determine a customer’s eligibility for credit,^*” 

The growing use of affiliate sharing under GLB for profiling and credit decision-making, as 
confirmed by the Citigroup Senate testimony, will lessen the public benefits of the FCRA. When 
credit decisions are made on the basis of affiliate-shared information, consumers do not have the 
same bundle of rights as they do under FCRA. As internal creditor databases increase in size and 
predictive value, either credit decisions or other profiling decisions (whether to even offer a 
consumer a certain class of product, for example) will more and more be made under the GLB 
regime. These adverse actions will not result in triggering the same disclosures and rights that 
consumers obtain under the FCRA. These changes in the marketplace, which are already 
occurring, mean that consumers may not have the same credit rights in the future. 

B) Any reform bill must improve the inadequate regulation of pre-screened 
solicitations 

Credit bureaus also sell under-regulated pre-screened lists of consumers derived from credit 
reports, for credit and insurance related purposes. Pre-screened opt-out notices are hard to find 
and harder to read; the opt-out mechanism is overly complex and, for a permanent opt-out, a 
consumer must make a call, receive a notice in the mail, sign it, stamp it and return it.^'* The 
unnecessary complexity contrasts starkly with the much simpler national Do Not Call list 
recently implemented by the FTC which has received overwhelming consumer response. 

C) Any Reform Must Address Medical Privacy Problems 

Testimony by CFA has documented how medical information could be improperly inferred from 
trade lines in credit reports, a problem which could be resolved by coding of the information. 
Detailed House testimony from the Electronic Privacy Information Center’® and Georgetown 
University Health Policy Institute assistant professor Joy L. Pritts” documented how neither the 
FCRA nor the GLB prevent the sharing of confidential medical information among corporate 
affiliates, including banks. Commendably, HR 2622 narrows this affiliate-sharing loophole 
significantly although we recommend additional changes (see recommendations below). While 
HR 2622 appears to address the coding problem as marked up in full committee, we understand 
that the coding amendment may be removed before floor action. 
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D) Any Reform Must Protect Workers From Unfair Investigations 

Another major flaw with H.R. 2622 is its treatment of employment related investigative reports. 

The bill would simply exclude such reports from the definition of consumer reports. This 
amendment eviscerates the cuiTcnt protections under the FCRA for workers. While we agree 
that changes are necessary to address investigations b^ed on employee misconduct, the 
proposed amendments are not balanced. Workers who are victims of false accusations must be 
protected as well. Whistleblowers and workers attempting union organizing drives must also be 
protected. Yet, investigations of employees without notice to the employees, even after the fact, 
have the potential to deter legal worker conduct and intimidate employees. We recommend a 
more comprehensive and balanced means of addressing the issue of employee misconduct and 
investigations into such conduct, along the lines of the FTC proposal from 2000, or the proposed 
changes that were negotiated between all interested parties in 2000, wiien a similar attempt was 
made to undercut employee protections in the FCRA.^^ 

At the end of our testimony, we provide a comprehensive list of provisions designed to improve the 
FCRA’s accuracy, identity theft and privacy provisions and compare these to the provisions in HR 2622. 

4) Conclusion 

While HR 2622 includes several laudable provisions, it does not address all the important 
problems identified in that committee’s detailed hearing record. Too many of the largest 
problems are deferred to studies, rather than solved. For example, instead of solving the 
completeness problem, as we recommend, the issue is deferred. Instead of shortening 
reinvestigations, the issue is deferred. Instead of banning the use of credit scores in insurance, the 
issue is deferred to a study. 

Yet, some prominent members of the House committee are already calling the bill a “landmark” 
identity theft reform and a “comprehensive” solution, hoping that its modest positive provisions 
provide enough cover to achieve industry’s goal of preempting state laws permanently. That is 
disappointing. Conversely, the Senate Banking Committee has an historic opportunity to do a 
better job of protecting privacy, ensuring the accuracy of credit reports and preventing identity 
theft without trampling on the rights of the several states to continue to be part of tlie solution. 

Industry witnesses refer to a number of white papers and pseudo-academic documents purporting 
to prove that either eliminating state preemption or providing greater financial privacy 
protections will cost the economy “billions of dollars.” In our view, these papei^s are based on 
specious assumptions. Harvard Law School Professor Elizabeth Warren, co-author of several 
major peer-reviewed studies of the impact of bankruptcy on consumers, has written an extensive 
article criticizing the use of such “proprietary” research (data not available or peer-reviewed, 
paid for by industry associations that hire academic “research” centers) to make public policy.^ ' 

We generally agree with industry tliat a uniform national law would be the most efficient, 
provided it is adequate. But the best way to get to adequate uniformity is to retain state 
authority. Congress has not demonstrated a propensity for enacting uniform consumer protection 
laws that are adequate, except when driven by the threat of state actions. If Congress fails to 
solve the problem, or new problems arise, the states can act more quickly to resolve the problem 
and provide a template for additional federal action by the Congress. Alternatively, we would 
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need to wait for a privacy Enron, or a consumer Exxon Valdez, before Congress acted again, and 
that is the wrong way to make public policy. 


We hope to work with the Senate, and with Members of the House, to significantly improve HR 
2622’s provisions on identity theft, privacy and accuracy and to eliminate HR 2622’s unfair 
preemption of state laws. We hope that the Senate alternative to HR 2622 more properly reflects 
the national consensus identified in the recent CFA consumer survey that Congress needs to do a 
better job protecting consumers while presertdng state authority. 

5) APPENDIX: 

Consumer Groups’ List of Minimum Consensus Reforms To F'ix The FCRA 
and Comparison to HR 2622 as A Benchmark 

Provide Consumers With Greater Rights to Enforce the Law: 


1. Provide consumers injunctive relief, minimum statutory (liquidated) damages and attorney’s 
fees for successful actions. HR 2622 does not address at all changing the FCRA so that 
consumers can ask a court to stop a credit bureau from reporting false negative information. 

2. Provide consumers with minimum statutory (liquidated) damages of $ 1 00-$ 1 000 for each 
violation. Some courts have ruled that a violation of the FCRA has not occurred unless a 
consumer can prove actual damages. More generally, the difficulty in proving actual damages 
has acted as a barrier to consumers being able to retain counsel to enforce the law. Further, it is 
difficult to prove certain actual damages, such as the value of the loss of your good name in 
identity theft situations. HR 2622: no improvement to existing law. 

3. Increase the standard of care for furnishers (creditors) to avoid making errors. 

The McCarthy amendment added in the House (also sponsored by Rep. Frank) establishes a 
good standard for furnishers to reinvestigate inaccurate information when requested to do so by 
the consumer. Requiring furnishers to reinvestigate their own information and ensure that it is 
accurate, after being notified by consumers that their information is incorrect is essential to 
making the FCRA work the way it was intended to. 

It is important to make several changes to this requirement. The most important is to establish 
the requirement in a different place in the statute. Currently the amendment is placed in §623(a) 
(15 U.S.C. §1681s-2(a)), rather than in § 623(b). This is incorrect, it should be placed in Section 
623(b) which already deals with the obligations of furnishers upon notice of a dispute. 

While the House bill, with the McCarthy amendment provides consumers the important right to 
dispute directly with the furnisher, it leaves consumers no recourse when the reinvestigation is 
inadequate and does not correct the disputed information. Section 623(a) provides no private 
right of enforcement. The FTC specifically recommended that the consumer's right to request a 
furnisher to reinvestigate disputed data must be in subsection (b), in order to create an 
affirmative duty on the funiisher. 

3. Maintain voluntary reporting, but require furnishers that report to abide by a completeness 
standard to prevent creditors from gaming the credit scoring system and deflating their 
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customers’ credit scores to prevent them from shopping around. HR 2622, in full committee, was 
amended to improve FCRA Section 623(a)’s weak standard for furnishers to avoid inserting 
inaccurate information into credit reports. While the House used the stricter Massachusetts 
standard of care (that was grandfathered into the 1996 FCRA amendments) as a template for this 
amendment, it deleted important provisions from the Massachusetts law’s requirement for 
“complete” reporting. 

4. Give consumers an FCRA right to contact furnisher directly to initiate reinvestigation. Add 
duties on “furnishers and users” to improve accuracy and conduct 1681(i) reinvestigations. HR 
2622 takes steps in this direction. It includes a version of the FTC and Treasury Department 
recommendation that allows consumers to initiate a re-investigation by directly contacting a 
furnisher (creditor). However there is no requirement that furnishers report disputes to the 
appropriate CRAs. 

5. Shorten the act’s 30-45 day reinvestigation period to 1 0 - 1 5 days. The bureaus already 
provide shorter reinvestigations in certain circumstances. The credit bureaus have a well- 
documented system that provides “concierge” services for certain classes of consumers. VIPs 
and consumers who are suing the bureaus generally can get complaints resolved more quickly. 
However, the most efficient reinvestigation systems are provided for consumers working with 
certain mortgage entities, where rapid re-scoring can gain a correction in 24-48 hours. Yet 
Section 303 of HR 2622, “Prompt Investigation of Disputed Consumer Information,” only 
requires the Federal Reserve System and the FTC to study the extent to which reporting agencies 
are complying with the current procedures and time lines under the FCRA for the prompt 
investigation and correction of disputed accuracy. Amendments shortening the reinvestigation 
period in certain circumstances were rejected. 

6. Require regular, formal oversight and internal review of credit scoring algorithms and models 
to ensure full compliance with FCRA, ECOA and Fair Housing laws. This critical reform 
provision is not in any way addressed by HR 2622. 

7. Require FTC and other regulators to fully enforce the existing requirement to consider all 
information relevant to consumer’s dispute, including information provided by the consumer. 
Require CRAs to reject findings of so-called furnisher reinvestigations that conflict with such 
relevant information provided by the consumer. This critical reform provision is not in any way 
addressed by HR 2622. 

8. Reinstate 2-year discovery rule (or 7 years after violation) statute of limitations to sue credit 
bureaus, but ensure that protections apply to all victims, not only ID theft victims. HR 2622 does 
not address this provision. In 2001 in TRW vs. Andrews the Supreme Court held that consumers 
could only sue a credit bureau for 2 years following a violation, not two years following 
discovery of the violation. While a variant of the 2002 provision that passed the Senate as part of 
S. 1742 (Cantwell) provision is included in this year’s S. 22 (Daschle), it is defective at the 
request of the credit bureaus and would only apply to identity theft victims. In the last Congress, 
we understand that Senator Cantwell agreed to this limitation to avoid Banking Committee 
jurisdiction and delay of her bill; we do not see that as an issue at this time. We believe that the 
proper way to reinstate the discovery rule is to apply it to all victims, to make it 2 years after 
discovery with a maximum of seven years (the same period bureaus can generally issue reports 
containing negative information). The provision should also include an estoppel provision so that 
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when a credit bureau intentionally misrepresents any information required, an action may be 
brought at any time within two years following discovery of the misrepresentation. 

9. Eliminate reseller and specialized credit bureau exceptions. The House bill would exempt 
resellers and certain specialized credit bureaus ftom certain of the bill’s provisions. While the 
industry has been successful in convincing several states to adopt similar language in their 
identity theft refonns, this provision is opposed by consumer groups, by identity theft victim 
organizations, and, we understand, by the National Credit Reporting Association, which 
represents many resellers. We believe that the intent of the provision is to undercut the FTC’s 
strict enforcement stance in the First American Credco^'* consent decree — which held that 
resellers should be treated the same as any other credit bureau. Credco should not be undercut by 
HR 2622. 

We also believe that while the Carson amendment to HR 2622 commendably clarified that 
resellers could still assist in reinvestigations, we are troubled by that bill’s CDIA and FTC- 
backed provision encouraging all reinvestigations to be coordinated through the three national 
repositories’ automated reinvestigation system. That automated system, incorporated in the 1 996 
amendments, was intended to expedite better reinvestigations. Instead, as detailed in the direct 
testimony before this committee of Evan Hendricks, editor and publisher of Privacy Times, the 
automated reinvestigation system has enabled the bureaus and furnishers to communicate 
“reason codes” by email while ignoring detailed dispute files provided by aggrieved 
consumers.” This was in no way what Congress ordered the industry to do. 

10. Require FTC annual audit of credit bureaus. Require the major credit bureaus to provide the 
FTC and state Attorneys General with detailed annual reports on the accuracy and privacy of 
their databases, including information on their testing of the veracity of their record-keeping, 
statistical information on the completeness and accuracy of the information provided by 
furnishers (creditors) and information about the number of and disposition of consumer 
complaints. Require the FTC to publish a summary of these records to the public that is adequate 
to assist the development of public policy and to help consumers make choices about which 
credit report to request, while of course maintaining the sanctity of reasonable and legitimate 
trade secret information. 


Give Consumers More Information About Their Reports 

1 . Provide an annual free credit report that includes a credit score on request of any consumer, 
expand the opportunities for certain consumers to gain additional free reports, and cap prices of 
credit report monitoring and alert services. Since reports are often full of mistakes and can be 
sold into commerce for credit purposes without consent^^ consumers deserve the right to audit 
them for free before they are sold. Since scores are used interchangeably with reports and are a 
mathematical summary of your report, free reports should include scores. Commendably, HR 
2622 would make annual free credit report rights granted for many years in six states (Colorado, 
Georgia, Maryland, Massachusetts, New Jersey and Vermont) the law of the land. However, the 
proposal was undercut in two ways. First, the provision now allows bureaus to charge a 
“reasonable fee” for credit scores, USA Today has reported that direct-to-consumer sales by 
credit bureaus will reach $1 billion this year, according to a leading investment banker. The story 
states: “Prices range from $13 for one report with a credit score to $100 a year for ongoing 
monitoring of multiple credit files. Frances Morris of Newark, Ohio, pays $160 a year to monitor 
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her credit files and those of her husband, Raymond.’^” Since the reports and scores are used 
interchangeably by lenders, and often sold to consumers as package, the utility of the free credit 
report is now undercut. 

Second, the Baker amendment to HR 2622 provided that free credit reports would only be 
provided on request by national bureaus, not all credit bureaus. Other credit bureaus need only to 
continue to provide free reports on request from potential fraud victims, indigent consumers and 
unemployed consumers,. 

Instead, any Senate bill should provide for a free credit report and score annually on request to 
any consumer from any credit bureau. All credit bureaus should also be required to provide 
additional free reports to potential fraud victims, indigent consumers and unemployed 
consumers, as FCRA Section 612(c) now provides. 

Further, since the bureaus have aggressively capitalized on the identity theft epidemic (that their 
practices are partly responsible for) by selling expensive credit reporting monitoring services for 
as much as $99-1 20/year, Congress should cap the price of these services at as little as $9- 
29/year. Notably, recent press reports have accused at least one of the bureaus of using deceptive 
marketing of “free credit reports” to sell these services.^** 

2. Provide consumers with detailed explanations as to why credit is denied or less-than-favorable 
terms are offered. HR 2622 requires only a minimal summary or explanation credit scores. In its 
study of credit score accuracy, CFA found that approximately seven in ten credit reports 
indicated that the primary factor contributing to the credit score was “serious delinquency,” 
“derogatory public record,” “collection filed,” or some combination of these factors. This 
generic and extremely vague information provided by creditors when they take an adverse credit 
action is too general to be helpful, especially for most sub-prime borrowers, who by definition 
have some credit blemishes. Instead, lenders should be required to identify any specific entries 
(trade lines) that are lowering a consumer's score and indicate the impact on the consumer 
(either the point value deducted for that entry or the proportional impact relative to other 
derogatory entries.) 

Any Senate bill provision similar to the House bill’s credit scoring disclosure requirements 
(which are based on California law) should not only not allow fees, but should not preempt 
broader state credit score disclosure rules. In the 107'*' Congress, S 1242 (Allard-Schumer) also 
adopted California law nationwide, but preempted all other state credit score laws, even though 
its applicability was limited to mortgage lending. 

3. Give consumers the right to automatically obtain a credit report and score directly from a 
lender when an adverse action is taken. HR 2622 does not address this important reform. 
Consumers face two problems when they request a credit report (and score) from a credit bureau. 
First, any adverse actions previously taken were based on a subscriber credit report provided to 
the lender. The subscriber report is often provided based on a limited number of matching data 
points and is more likely to contain inaccurate or mis-merged infoniiation about other consumers 
than a report requested by a consumer, since a consumer must provide a detailed match of name, 
address, and Social Security Number. Second, a score derived from that consumer report will 
probably differ from the score the subscriber obtained from the less accurate report. 

The FCRA already requires that employers contemplating adverse actions show 
consumers a copy of their report. The FCRA should be amended so that after a lender takes an 
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adverse action, the consumer would automatically receive from that subscriber a copy of the 
subscriber report and score used in the adverse action. 

Giving consumers access to the subscriber report, which is much more likely to contain 
false negative information would have a great impact on credit report accuracy. Providing a 
report immediately following denial would also be a powerful educational tool for consumers. 

4. Require creditors to identify any counter-offer or offer of credit at less than the most favorable 
terms as an “adverse offer,” as has been called for by the Federal Trade Commission, requiring 
provision of an adverse action notice, which triggers all the concomitant FCRA rights. This 
would include pre-screened “sub-prime” mortgage offers or credit card solicitations that are 
based on negative or less than favorable credit information. As is well known, the sub-prime 
credit industry has boomed in the past decade by offering borrowers with blemished or limited 
credit histories mortgage loans, car loans and credit cards at higher rates and less favorable terms 
than offered to their “prime” borrowers. As lenders increasingly offer a continuum of loans at 
different rates and terms, it is more important than ever that consumers have the ability to 
exercise their FCRA rights to insure that adverse credit information is correct. In the world of 
“risk-based” pricing, borrowers should know that they are being targeted because of their less 
than optimal credit history and should be offered the opportunity to check their credit history and 
change any information that is not accurate or complete. Furthermore, as stated above, many 
consumers are unwittingly giving up their FCRA rights because they are accepting loans that are 
legally considered “counteroffers.” 

5. Notify consumers when negative information is reported. The Flouse bill, FIR 2622, includes a 
weakened version of a proposal by Rep. Ackerman to guarantee that consumers be warned by 
their creditors that negative information has been sent to a credit bureau. An even stronger 
alternative, already law in Colorado, requires that credit bureaus provide an annual notice of 
rights to consumers. The notice is sent to all consumers who have received one negative item or 
8 inquiries generally on their reports. This could be improved by adding a third category — “or 
had a request for an address change on their reports” (in which case the notice should be sent to 
the old and new addresses). 

Provisions To Fight Identity Theft And Improve Accuracy 

1 . Give consumers the right to impose security freeze blocking of their credit reports at no 
charge (blocking of their entire report from access unless a PIN or secret code is provided). HR 
2622 only provides to the consumer the ability to "block" fraudulent trade line infomiation 
resulting from ID theft. Blocking a fraudulent trade line is important, but the right to control 
access to a credit report is much more significant. 

2. Require full name and contact information, including phone number, with all trade lines on 
credit report. This will make it easier for consumers to investigate complaints. HR 2622 appears 
to address this, through the Shennan amendment, but does not fully address this important 
problem. Its provision is too permissive. 

3. Require fumishers/bureaus to match 4 points of identification before issuing a subscriber 
report. HR 2622 does not address this provision, which is arguably the most significant and 
important change that could be made to deter identity theft. Identity theft and mis-merged files 
regularly occur because the bureau fails to accurately ensure that an application provided by a 
subscriber matches the report that is issued. California already requires 3 points of 
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identification.^'^ Sloppy creditor and credit bureau practices in the granting of “instant credit” are 
the door opened by identity thieves, who take advantage of easy access to the key to your 
financial identity, your Social Security Number (see #8 below). 

4. Impose stricter address change verification requirements. HR 2622’s address change 
provisions are extremely limited and allow the credit bureaus to ignore them unless “substantial 
variations” occur. Further, the provisions exclude reseller and specialized credit bureaus. 

5. Give a consumer a right to put a fraud flag on his or her credit report and impose penalties for 
bureaus selling/issuing any subscriber report where fraud flag is not prominent. HR 2622 
includes a provision making it a violation for a bureau to issue a report without a fraud flag. 

6. Impose penalties for a furnisher issuing credit on any report with a fraud flag. 

Title 11 of HR 2622 prohibits the user (requester) of the consumer’s report from extending credit 
in the name of the consumer without first attempting to obtain pre-authorization of the consumer 
who placed the fraud alert. The provision may he too permissive. 

7. Require credit card number truncation. The House bill commendably codifies federally 
several state laws requiring truncation of credit card numbers on most receipts, to reduce the risk 
of fraud. However, as noted above, its absurdly long implementation period (2007) ignores more 
stringent state timetables and even a nationally-announced timetable by the VISA network, 
Further, these provisions may preempt the shorter timetables and any state laws that require 
truncation in broader circumstances. 

8. Get the Social Security Number out of circulation. HR 2622 does not address the ubiquity of 
Social Security Numbers. Social security numbers are the key that opens the door to your 
financial identity. We believe that the recent DC Circuit, U.S. Court of Appeals decision 
removing SSNs from credit headers'"’, which are unregulated information products sold by the 
bureaus outside the FCRA, should be codified in federal law as an amendment to the FCRA.’” 

We also believe that the Senate Finance Committee should enact the additional provisions 
included in S 1014 (Burming) from the 107th Congress, which would prohibit businesses from 
coercing consumers into providing their SSN as a condition as a condition of doing business. 

9. Prohibit selling or assigning debt to a debt collector where the consumer is an ID theft victim 
with respect to that debt. Not addressed by HR 2622. 

10. Give victims access to business records of all creditors including telecommunications 
providers when fraudulent accounts opened. Not addressed by HR 2622. This provision is law in 
California and is the subject of several bills from the 107th (S 1742) and 108th Congresses (S 
22). However, it should be enacted without a reseller exception, as S. 22 includes. 


Tools To Protect Privacy 

1. Eliminate two-tiered pre-screened credit card and insurance solicitations opt-out. Not 
addressed by HR 2622. The House bill does not eliminate the current consumer burden of a 
complex two-tiered opt-out system. Any final law should provide that all opt-outs, not only opt- 
outs made in writing after returning a “signed notice of election,” are permanent until rescinded. 
Under current federal law, a telephone opt-out is only good for two years. 
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2. Require pre-screening opt-out to use express, prominent language. Instead of requiring 
agencies to enforce the existing law requiring disclosures to be prominent, HR 2622 orders the 
agencies to conduct a rulemaking to improve the disclosure. If Congress goes forward with the 
rulemaking, it should specify that the agencies must require an express, statutory warning with a 
specified format. 

3. Close loopholes allowing inadvertent disclosure of medical information by bill collectors and 
other furnishers. While the House bill as approved by committee appears to do this, we 
understand that the provision may not remain in the bill. 

4. Ban sharing of medical information between affihates without express consent and then only 
for limited, one-time purposes. The House bill includes a landmark reform that does accomplish 
much of this goal. The House bill’s definition of medical information needs to be expanded. It 
includes only "information or records obtained, with the consent of the individual to whom it 
relates, from licensed physicians or medical practitioners, etc." It should include mental health 
information. The narrow definition also may leave some information provided directly to life 
insurers (e.g,, health information that is obtained directly from applicants) vulnerable since it is 
not within the definition of "medical information." Neither would that information qualify as an 
"individualized list or description based on a consumer's payment transactions." Since this 
information does not fit within the amendment to 603(d) it would probably still be excluded from 
the definition of credit reports and could be shared as either transaction or other information. We 
also have concerns about the banking agencies receiving authority to determine when disclosures 
of medical information are necessary. These agencies may not have adequate expertise in the 
medical area. In addition, as pointed out above, we would urge the committee to reiterate that the 
states have clear authority under the Gramm-Leach-Bliley Act and FCRA to further regulate 
affiliate sharing, in particular, by the insurance industry. 

5. Ban the use of credit scores in insurance. Consumers with excellent insurance claims records 
are routinely being non-renewed or having homeowners or auto insurance rates raised on the 
basis of credit scores, which are based on inaccurate credit reports. HR 2622 does not address 
this critical issue. 

6. Require any agency or business that possesses a citizen’s or consumer’s computerized data to 
adhere to a security breach notification law. While the House Financial Services committee held 
an entire hearing’'^ devoted to the serious problem of security breaches, as epitomized by the 
recent Tri-West, Tele-Data and University of Texas cases, nothing in HR 2622 bill would require 
data collectors (government or private) to notify consumers of computer hacks or other theft of 
databases resulting in threats to their privacy. California has enacted legislation requiring 
minimal notification standards which at a minimum should be adopted by Congress. Senator 
Feinstein has introduced legislation, S 1 350, based on California law. Both the California law 
and S 1350 include a notification loophole that should be closed. 

7. Prohibit risk-based re-pricing (bait and switch). During consideration of HR 2622, a tri- 
partisan Sanders-Bachus-Maloney amendment to restrict this practice was rejected. Credit card 
companies should not be allowed to raise their customers’ interest rates to penalty rates of 25% 
APR or more, based on their credit scores or alleged minor delinquencies to a different creditor. 
The problem is exacerbated by the fact that some of these same credit card companies may also 
be deflating their customers’ credit scores through incomplete reporting. 
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Protect Employee Privacy 

1 . Ensure that the use of credit reports for employment investigations does not violate employee 
privacy, impede whistleblowers or block lawful union organizing. HR 2622, instead, wrongly 
exempts many employee investigations from the definition of credit report by incorporating the 
provisions of legislation originally proposed by Rep. Pete Sessions in 2000. This is an 
unnecessary and far too broad a response to problems which can arise If om the requirement to 
notify all employees of an ongoing, third party investigation in the workplace. 

The privacy protections in the FCRA were applied to the employment arena deliberately and 
appropriately after findings of serious abuses of employees. The investigated employee may be 
the wrongdoer or the victim. Broad scale exceptions to this important taw should not be carved 
out based solely on the assumption that every investigated employee is guilty. If not guilty, the 
employee may be more than just mistakenly accused. The accusation against the employee may 
be malicious and vindictive, because the employee is a woman in a male environment, a union 
organizer, a minority person, or simply disliked by someone. Any introduction of increased 
secrecy in employers' third party investigations must be balanced by an understanding that the 
secrecy can foster injustice as well as help ferret out injustice. 

In 2000, after the House Financial Services Committee first held a hearing on the Sessions bill, 
representatives of consumer groups, (National Consumer Law Center and U.S. PIRG), labor 
(AFL-CIO), civil rights groups (Lawyers Committee for Civil Rights), and the administration 
(FTC), met with an assortment of industry groups (including the U.S. Chamber of Commerce, 
employer representatives, as well as third party investigators). Our joint goal was to produce an 
alternative proposal to the Sessions bill which would address the legitimate problems articulated 
by employers using third parties to investigate employee misconduct, while continuing to protect 
employees from overreaching investigations breaching privacy and basic rights of employees. 

After numerous meetings, an alternative proposal had been agreed to in principle by all parties, 
with a number of specific terms still to be worked through. The Congress should revisit that 
compromise proposal rather than adopt the HR 2622 provisions. The FCRA currently provides 
important rights to employees in the workplace. There is no justification for a complete reversal 
of those rights. 

2. Ensure that users of consumer reports for employment purposes comply fully with FCRA 
provisions. HR 2622 does not address this issue. At a minimum, the FTC needs to conduct a 
study to detennine whether employers using credit reports for adverse actions are complying 
with the act’s expanded 1 996 provisions. To our knowledge, the FTC has not found any 
employer in violation of the FCRA since the early 1990s, even though during the hearings and 
meetings in 2000 many employers and employer associations claimed to have no idea that the 
FCRA had any applicability to employment. 
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' In terms of that detailed record, we associate this testimony with the recommendations several of our organizations 
have made in previous appearances before the committee, as well as with those of the Vermont Attorney General’s 
Office and other pro-consumer witnesses. In particular, just two days ago, the Consumer Federation of America 
presented the committee with detailed evidence of widespread consumer support for improvement in the law, based 
on the national findings of a recent statistically valid poll. 

■ Testimony of Martin Wong, General Counsel, Citigroup, before the U.S. Senate Banking Committee, 26 June 03, 
available at httD://banking. senate. gov/03 06hni/062603/wong.pdf 

^ See direct testimony of U.S. PIRG Consumer Program Director Edmund Mierzwinski before the U.S. Senate 
Banking Committee, 26 June 2003. httn:/V'banking.senatc.gov/03 061irg/0626()3/mierzwin.pd f 
See direct testimony of Vermont Assistant Attorney General Julie Brill before the U.S. Senate Banldng Committee, 
26 June 2003, at pages 22-27 for detailed discussion. httt?:/./banking.scnate. gov/03 06hfg/062603/brill.pdf 
^ Throughout, we use the term “credit bureau” as well as the statutory term “Consumer Reporting Agency” or 
“CRA.” 

Bank of America, NA vs. City of Daly City, USDC C 02 4343 (ND CA) Decision available at 
http://www.co.sanmateo.ca.us/vgn/images/DOi1al/cit 609/73485048District%20Coi]i1.Ddf 
^ “Credit Score Accuracy and Implications for Consumers”, December 17. 2002, Consumer Federation of America 
and the National Credit Reporting Association 

http:/7ww w. consumc rfed.org/121702CFA NCRA Credit Score Repo rt Fin ai.pdf See direct testimony of Stephen 
Brobeck, Executive Director, Consumer Federation of America, before the Senate Banldng Committee, 10 July 
2003, at htt p://b ankj ng .senate.gov/,. files/brobeck.pdf 

^ See also the direct testimony of Paul Wohkittel, Legislative Chairman, National Credit Reporting Association, 
before the Financial Institutions Subcommittee, 4 June 2003 at 
http://financialservices.house.gOv/media/pdf/060403pw.pdf 
See direct testimony of Allen Fishbein, General Counsel, Center for Community Change, before the Subcommittee 
on Financial Institutions, 12 June 2003, at http://fmancialseivices.house.gov/media/pdf/061203af.pdf 
Direct testimony of Mr. Hillary Shelton. NAACP, before the House Financial Services Committee, 9 July 2003, at 
http://f inanciaI s erv ices ,house.gov/'media/pdf 070903hs.pdf 

' ' See direct testimony of Dr. William Spriggs, PhD., Director, National Urban League Institute for Opportunity and 
Equality before the House Committee On Financial Services, 9 July 2003 
htt p://fman cia l seivices.hou se.go v/media-'pdf 0709 03ws.pdf 
See direct testimony of Shanna Smith, Executive Director, National Fair Housing Alliance, before the 
Subcommittee on Financial Institutions, 4 June 2003, at http://financialservices.house.gov/media/pdf/Q6()4Q3ss.pdf 
Executive Summary, “Risk or Race? Racial Disparities and the Sub-prime Refinance Market.” A Report of the 
Center for Community Change, Prepared by Calvin Bradford. Calvin Bradford & Associates, Ltd. May 2002 
Available at http://www.communitychange.org/NRP/riskorrace.asp 
See direct testimony of Ed Mierzwinski, Consumer Program Director, U.S. PIRG before the Subcommittee on 
Financial Institutions, 4 June 2003, at http://financialservices.house.gov/media/pdf/060403em.pdf 
“Surprise Jumps in Credit Rates Bring Scrutiny,” by Jennifer Bayot, The New York Times, 29 May 2003, Page 1 . 
16 ' Hearing to Shine Spotlight on Credit Process,” American Banker, 12 June 12, 2003 by Michele Heller, 

See “An Overview of Consumer Data and Credit Reporting,” Avery et al, February 2003, Pages 47-73, Federal 
Reserve Bulletin http://www.federalreserve.gOv/pubs/bulletin/2003/02031ead.pdf Also see Working Paper No. 02- 
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htt p://w w w.phil.f rb. o rg/ files/'^x 'ps/2002/wp02-2 1 .pdf 
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and a scanned copy of a so-called notice http://financialservices.house.gov/media/pdf/060403em.pdf 
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and U.S. PIRG, by Margot Saunders of NCLC. The testimony includes an appendix detailing the views of the AFL- 
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RESPONSE TO WRITTEN QUESTIONS OF SENATOR DOLE 
FROM JOHN W. SNOW 

Q.l. Our credit system is based on a voluntary reporting system in 
which it is in the furnisher’s best interest to report information to 
the credit bureaus. Do you believe that some of the duties imposed 
on the furnishers by the House bill could jeopardize the willingness 
of furnishers to participate in the system? 

A.l. We support H.R. 2622 and commend Chairman Oxley and 
Ranking Member Frank for their hard work. However, some provi- 
sions go too far. The new requirements concerning the accuracy of 
consumer information contained in H.R. 2622 were not in the Ad- 
ministration’s proposal. We are concerned that these new require- 
ments may lead to some furnishers dropping out of our voluntary 
credit reporting system or simply deleting disputed information. 
This would not advance consumers’ interest in the security and the 
completeness of their credit reports. We have been working with 
the House to resolve these concerns to ensure that we maintain a 
robust, national credit reporting system and protect consumers’ in- 
terests in access to credit and other financial services, while at the 
same time protecting their interest in the accuracy and security of 
their information. My staff and I would be pleased to discuss the 
matter further with you and Members of the Committee. 

Q.2. The House accepted an amendment to allows consumers to go 
directly to a furnisher, whether it be a retailer or a bank, to dis- 
pute what they believe to be incorrect information on their credit 
report. Does the Treasury have a position on this language? What, 
if any changes to the language, would the Treasury recommend? 
A.2. We support H.R. 2622 and commend Chairman Oxley and 
Ranking Member Frank for their hard work. The new proposal to 
allow consumers to initiate disputes directly with furnishers con- 
tained in H.R. 2622 was not in the Administration’s proposal. We 
are concerned that this proposal may lead to some furnishers drop- 
ping out of our voluntary credit reporting system. Also, a corner- 
stone of both the Administration’s proposal and H.R. 2622 is the 
ability for all consumers to obtain a free credit report every 12 
months from each of the three nationwide consumer reporting 
agencies. If this becomes law, consumers will be more familiar with 
the role of the consumer reporting agencies. Given this likely great- 
er familiarity, it makes sense to direct consumer disputes to the 
consumer reporting agencies, which can efficiently refer the dis- 
putes to the appropriate furnisher. We are working with the House 
to resolve these concerns to ensure that we maintain a robust, na- 
tional credit reporting system and protect consumers’ interests in 
access to credit and other financial services, while at the same time 
protecting their interest in the accuracy and security of their infor- 
mation. My staff and I would be pleased to discuss the matter fur- 
ther with you and Members of the Committee. 

Q.3. It’s my understanding the 1996 Amendments to the FCRA 
gave credit bureaus the ability to dismiss consumer disputes they 
deem to be frivolous. If Congress decides to allow consumers to reg- 
ister disputes directly with furnishers, should we give furnishers 
the same ability to dismiss frivolous claims? 

A.3. Yes. Frivolous claims should on no account be acceptable. 
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August 6, 2003 


Honorable John W. Snow 
Department of Treasury 
1500 Pennsylvania Avenue, NW 
Washington, DC 20220 

Dear Secretary Snow: 

I want to express my concern about the impact of IRS Announcement 2003-46, which 
suspends Section 29 tax credits private letter rulings for solid coal-based synthetic fuels, on 
taxpayers. The Announcement could impact at least ten Kentucky facilities that have invested 
millions of dollars in reliance on these rulings. 

The IRS Announcement has created confusion, leaving taxpayers uncertain as to whether 
they will be able to earn back the investments they made in reliance on the tax law. This 
uncertainty affects not only coal producers, but also investor-owned utilities, electric 
cooperatives, as well as companies in the insurance, hospitality, and transportation sectors who 
have made investments in synthetic fuels in reliance on the nearly twenty year law. As a result of 
the Aimouncement, many Section 29 taxpayers have lost substantial market capital, have had 
their jobs threatened, and have had their business stalled. This situation threatens to worsen as 
progress on a resolution of this issue proceeds at a slow pace. 

Given the potential economic disruption that continued delay of resolution of this issue could 
cause, I respectfully ask that you meet with the CEOs of the affected companies as soon as 
possible to hear their concerns and that you review this matter in a expeditious manner so that 
taxpayer confusion is eliminated. 

Sincerely 


JIM SUNNING 
United States Senator 
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CONSUMER CREDIT 

Limited Information Exists on Extent of 
Credit Report Errors and Their 
Implications for Consumers 


What GAO Found 

Information on the frequency, ^pe, and cause of credit report errors is 
limited to the point thm; a comprehensive assessment of overall credit report 
accuracy using currently available information is not possible. Moreover, 
available literature and the credit reporting industry strongly disagree about 
die frequency of errors in consumer credit reports, and lack a conunon 
definition for “inaccuracy.” The literature and industry do identify similar 
types of en'ors and simUar causes of errors. Specifically, several officials and 
reports cited collection agencies and governmental agencies that provide 
information on bankruptcies, liens, collections, and other act ions noted in 
public recoids as major sources of errors. Because credit report accuracy is 
essential to the business activities of consumer reporting agencies and credit 
gi-anteis, the credit industry has developed and implemented procedures to 
help ensure accuracy. However, no study has measured the extent to which 
tliese procedures have improved ac-curacy. While the Federal Trade 
Commission (FTC) tracks consumer complaints on FCRA violations, these 
data are not a reliable measure of credit report accuracy. Addit ionally, FTC 
has taken eiglit formal enforcement actions directly or indirectly related to 
credit report accuracy since Congress enacted the 1996 FCRA amendments. 

Neithci' the impact of the 1996 FCRA amendments on credit report accuracy 
nor the potential implications of errors for consumers is known, 

Specifically, because comprehensive or statistically valid data on credit 
report errors before and after the passixge of the 1^6 FCRA amendments 
have not been collected, GAO could not. identify a. trend associated with 
error rates. Industiy officials and studies indicated that credit report errors 
could either help or hurt, individual consumers depending on the nature of 
the error and t he consumer’s personal circumstances. To ticleqiiately assess 
the impact of errors in consumer reports would require access to the 
consumer’s credit score and the ability to detennine how changes in the 
score affected the decision to extend credit or the terms of the credit 
granted. Ultimately, a meaningful independent review in cooperation with 
the credit industry would be necessary to assess the frequency of errors and 
the implications of errors for individual consumers. 
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Mr. Chairman and Members of the Committee: 

I appreciate the opportmiity to provide this committee with information 
on toe accuracy of consumer credit: repoits. Accurate cr edit; reports ar e 
critical for all consumers attempting to obtain credit and for leiuling 
institutions in making appropriate and timely decisions about extending 
credit. Information from credit reports is used to compile credit scores, 
which in turn are used as the basis for deciding whether to ext end credit, 
and for setting rates and terms for mortgages and otiier consumer iomis. 
Thus, inaccurate credit report data could have significant monetary 
implications for individual consumei's and credit granters in today’s 
sophisticated and higlily calibrated credit markets. 

To help promote the accuracy, fairness, and privacy of personal 
infonnation assembled by consumer reporting agencies (CRAs), Congress 
enacted the Fair Credit Reporting Act (FCRA) in 1970.‘ Under FCRA, CRAs 
must “follow reasonable proc'ediires to assure maximum possible 
accuracy” in credit reports. In 1996, amendments to FCRA expanded the 
respoiivsibilities of data funiistiers, prohibiting tliem from knowingly 
providing inaccurate consumer information to a CRA in certain 
circumstances.* Additionally, FCRA gave the Federal Trade Commission 
(FTC or Commission) responsibility for enforcing compliance wito the 
ac(.’s provisions — to the extent tiiat this authority did not overlap t;he 
authority of other financial rcguiaton5 for specific institutions. 

In a series of hearings this committee has recently held on FCRA issues, 
questions concerning the accuracy of credit reports have surfaced. In 
recognition of the importance of this issue, you asked us to provide the 
committee with information on (1) toe frequency, nature, and cause of 
consumer credit repori. errors and (2) the impact of the 1996 FCRA 
ameiulments on credit report accuracy and the potential implications of 
credit reporting errors on consumers, 

The infonnation that we are providing is based on a review of the limited 
literaUire on the subject, and on interviews and supporting documentation 
obtained from tlie three nuyor CRAs; toe Consumer Data Industry 
Association (GDIA), a trade association for tlie consumer reporting 
agencies; the National Foundation for Credit Counseling (NFCC), a 


’Piib. L. No. 91-508, (15 U.S.C. § 1681 et. seq.). 

^Consumer Credit Rqjoiling Reform Act of 1996, Pvib. L. 104-208, 110 Stat. 3009-426. 
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national nonprofit credit counseling network; the Federal Trade 
Commi^ion (FTC); tiie Federal Reserve; and five data furnishers."* While 
we asked the three major CRAs to pro\ide data on the frequency, type, and 
cause of errors in credit reports, they told us that they did not have data 
that would specifically respond to our request. The CRAs also told us that 
tliey compete with each other on the basis of the accuracy and 
completeness of their <*redit reports and were reluctant to provide us with 
any data tliey considered proprietary. However, they did agree to provide 
available information on consumer disputes to CDIA, their trade 
association, which provided that data to us in aggregated form. 
Consequently, we were unable to independently verify the accuracy of this 
data. Except for tliis limitation, we condu(*ted our work in accordance 
with generally accepted government auditing standards from June through 
July 2003. 

In summary, we found that information contained in tlie literature and the 
available industry data on the fretjuency, tyi3es, and causes of credit report 
errore are limited. Moreover, there is a large variance in the frequency of 
errors presented by the literature and industry data. Unfortunately, we 
cannot determine a definitive level of credit report accuracy because of 
the data limitations inherent to both the literature and industry data. 
However, the literature and industry had identified similar types of errors 
in credit reports, including the inclusion of incorrect information and the 
exclusion or incomplete reporting of information. Additionally, the 
literature and industry consensus was that the causes of errors included 
consumers, data furnisheis, mul CRAs. However, several industry officials 
and reports identified collection agencies and organizations providing 
public records data — on actions such as bankruptcies, liens, and 
collections — as being major sources of errors in credit reports. In an effort; 
to ensure accuracy of credit report data, the credit industry has developed 
and implemented procedures that standardized the manner in which 
information was collected and transnutted. The FTC tracks consumer 
complaints regarding possible FCRA violations and has taken eight 
enforcement actions as of July 24, 2003, direc^tly or indirectly related to 
credit report, data accuracy since the passage of the 1996 FCRA 
amendments. 


*1110 consumer reporting agencies we contacted were Equifax, Experian, and TransUnion. 
Tlie data ftiniishere that we contacted were Bank of Asiierica, Citigroup, Discover, MBNA, 
and JP Morgjui/Chase. 
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We eaimot readily determine the impact of the 1996 FORA amendments on 
credit report accura<^ or die potential implications of credit report errors 
on consumers. This is attributable to the lack of trend data availabk? on 
credit report errors. Specifically, no entity collects or maintains t he 
necesjary data for such an assessment. Similarly, we could not detennine 
the potential implications for consumeis of credit reporting errors due to 
the lack of <pia]ity information on the frequency of errors. However, 
industry officials smd studies suggested that errors and inaccuracies in 
credit reports have the potential to both help and hurt individual 
consumers. Minor inaccuracies iir a consumer’s credit file may not hurt a 
corrsumer if that individual liad a very good credit history. On tlie other 
liand, errors or inaccuracies in tire credit report of a consumer with a less 
than perfect credit history could result in the denial of credit or an offer of 
less favorable credit terms. So, tire impact of airy particular error or 
inaccuracy in a credit report is dependent oir the specific (urcaurrstances of 
the consumer. 

The lack of comprehensive information r egar ding the atrcuraxy of credit 
reports inhibits any irreaningfiil discussion of what could or should be 
done to improve credit report accuracy. Because of the importance of 
accurate credit reports to our national credit system, it would be useful to 
perfonrr an irrdependent assessmcrrt of the current: level of accuracy of 
credit reports. The assessment would then form the basis for a more 
complete and productive discussion of the costs and benefits of making 
clranges to tire current system of credit reporting to inrprove credit report, 
accuracy. Airother option for inrproving tire accuracy of credit reports 
would be to create more opportunities for consumers to review credit 
reports. When consunrers see their credit reports, they have a chance to 
kientify errors arrd ask for correc^tions, tirus helping to ensure greater 
overall accuraty of consumer- credit reports. 
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Information on 
Frequency, TVpe, and 
Cause of Credit 
Eeport Errors Is 
Limited; Industry Data 
and Available Studies 
Disagree on 
Frequency of Errors 


Available studies and credit reporting industry data disagree on tlie extent 
of errors in credit reports. The limited literature on credit report accuracy 
indicated hi^» rates of errors in credit report data. In contrast, the major 
CRAs and CDTA stated that they did not track eiTors specifically but that 
the data the credit industry maintained suggested much lower rates of 
errors. Botlx the literature and the data provided by the credit industry had 
serious limitations tliat restricted our ability to assess tlie overall level 
credit reporting accurttcy. Yet, all of the studies identified similar types 
aixd causes of errors. Wliile data provided by the credit industry did not 
address type and cause of errors, I'cprcscntativos from the three ma,ior 
CRAs and CDIA cited t 5 fpes and causes similar to those cited in the 
literature. Tlie credit industry lias developed and implemented proccdiu'es 
to help ensure accuracy of credit report data, although no one has 
assessed the efficacy of these procedures. Moreover, FTC tracks 
consumer disputes regarding the accuracy of information in credit reports 
and has taken ciglil onforcement actions directly or indirectly involving 
credit report accuracy since 1996. 


Literature Raised Serious Wc idcniificd Uirco studies complciod after the 1996 FCRA amendmoius 
Questions Regarding Level directly addressed credit report accuracy, and one that indirectly 
of Credit Report Accuracy addressed the topic. One of tliese reports, published in December 2002 by 
Consumer Federation of America, presents the frequency and types of 
errors drawn from files requested by mortgage lenders on behalf of 
consumers actively seeking mortgages. ‘ The Consumer Federation of 
America initially reviewed 1,704 credit files representing consumers from 
22 states and subsequently re-examined a sample of 51 three-agency 
merged files. In this sample of merged files, the study found wide variation 
in the information maintained by the CRAs, and that errors of omission 
were coimnon in credit reports. For example, the report stated Qiat about: 

• 78 percent of credit files omitted a revolving account in good standing; 

• 38 percent of credit files were missing a mortgage account that had 
never been late; 

• 67 percent of credit files omitted other types of installinent accounts 
that had never been late; 


'Consumer Federaticm of America and National Credit Reporting Association, Oml'd Scora 
Acctuvcy and ImplicalwTisfi/r December 2002. 
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• 82 percent of the credit files had inconsistencies regarding the balance 
on revolving accounts or collections; and 

• 96 percent of the credit files had inconsistencies regardhig an accoimt’s 
(Te<lit limit. 

A March 1998 tJ.S. Public Interest Research Group (U.S. PIRG) study 
found similar frequencies of errors in 133 credit files representhig 88 
individual consumers.® U.S. PIRG reported that 70 percent of the files 
re\newed contained some form of error. The errors ranged in severity from 
those unlikely to have negative repercussions to those likely to cause a 
denial of credit. For example, die report found: 

• 41 percent of the credit files contained personal identifying information 
Uial was long-outdated, belonged to someone else, was misspelled, or 
was otherw'ise incorrect; 

• 29 percent of the credit files contained an error — accouhLs incorrectly 
marked as delinquent, credit accounts that belonged to someone else, 
or public records or judgments that belonged to someone else — tltat 
U.S. PIRG stated could possibly result in a denial of credit; and 

• 20 percent of the credit files were missing a major credit card account, 
loan, mortgage, or other account that demonstrated the 
cieditw'ortliiness of the consumer. 

Similar to the U.S. PIRG study, a 2000 survey conducted by Consumers 
Union and published by Consumei- Reports asked 25 Consumers Union 
staffers and their family members to apply for their credit reports and then 
review- them.* In all, Consumers Union staff and family members received 
and evaluated 63 credit reports and in more than half of the reports, they 
found inaccuracies tliat they reported as having tlie potential to derail a 
loan or deflect an offer for the lowcsl-intcrcst credit card. The 
in^-ciuacies ideiiLified were siniilai' to Uiose reported by Ute Consumer 
Federation of America and U.S. PIRG — inclusion of infonnation belonging 
to other consumers, inappropriately attributed debts, inaccurate 
demographic infonnation, and inconsistencies between the credit reports 
provided by the tliree major CRAs regarding the same consumer. 


T.^S, PIRG. Mistakes Do Happen: Credit kepoii Dnvrs Mean Consiimey-s Lose, March 
1998. 

^“Credit Reports; How Do Potential Lenders See You? ’ ComnnnfrrRfqMrfs.nijj, .July 2000. 
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Wliile not specifically assessing the accuracy of credit reports, a Federal 
Reserve Bulletin article found that credit reports contaiited 
inconsistencies and cited certain types of data furnishers, including 
collection agencies and public entities, as a primary source for some of the 
inconsistencies found/ Among the study's findings: 

• Approximately 70 percent of the consumers in the study’s sample had a 
missing credit limit on one or more of then rev olving accounts, 

• Approximately S percent of ail accounts showed positive balances but 
w'ere not up to date, 

• Between 1 and 2 percent of the files were supplied by creditors that 
reported negative information only, and 

• Public l ecords inconsistently reported actions such as baukruptc-ies 
and collections. 


An important aspccl of the Federal Reserve study was tliat it used a 
statistically valid and representative sample of credit reports, and received 
access to this sample widi the cooperation of one of the three ma,jor CRAs- 
iTowever, because the sample came from one CRA only, the findings of the 
study may not be representative of other CRAs. 


CRA and CDIA Data Representatives of the three miyor CRAs and CDIA told us tliat they do not 

Indicate Consumer maintain data on the frequency of errors in credit reports. However, the 

■p»j „ ^ Rayplv THpntifipH industi'y does maintain data tliat suggest errois are irifiequent in cases of 
Errors adverse action.^ CDIA stated that the three major CRAs provided or 

disclosed approximately 16 million credit reports, out of approximately 2 
billion reports sold annually in the marketplace. According to CDIA data, 
84 percent of the disclosures followed an adverse action and only 5 
percent of disclosures went to people who requested their reports out of 
curiosity. Out of these disclosures, CRA officials stated that an extremely 
small percentage of people identified an en'or. 


‘Robert Avery, Paul Calem, Glenn Canner, and Raphael Bostic, “An 0\’emew of Consumer 
Data and Credit Reporting,” Fedem! RfserDe TinUe.fin, February 200.“?. 

’’Wlien a creditor or lender decides not locxlend crexlit to an iTuliviiUial or not lo cxlc nd 
credit on the terms the individual requires and the indmdual does not accept a 
counteroffer, thisis considered an adverse action. After an adverse action, consumers have 
the right to a free copy of their credit report. 
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An Arthur Andersen study, conducted in 1992, found a similar infrequent 
rate of errors arising from adverse actions. Under commission by the 
Associated Credit Bureaus (now GDIA), the study reportedly found that 
only 36 consmiiers — out of a sample of 15,703 people denied credit — 
disputed erroneous information that resulted in a reversal of the original 
negative credit decision.*' Similarly, in an attempt to respond to our data 
request, CDIA produced data gathered by a reseller over a tw o-week 
period Uiat indicated tliat out of mortgage coitsuineis, only 2 
c;onsuiiaers (1 percent) liad a report that c-ontaiiied an inaccuracy. In our 
c'onversation witii data furnishers, we disc’overed that two conduct 
internal audits on tlie accuracy of the information they provide to die 
CRAs. These data furnishers indicated that the infonnation they provide 
and the CRAs maintain is accurate 99.8 percent of the time. 

WliUe consumer disputes do not provide a reliable measure of credit 
report accuracy, CRA representatives told us that disputes provide an 
indicator of what people perceive as errors when reviewing their credit 
files. A CDIA official stated that five types of disputes comprise about 90 
percent of all consumer disputes received by the three major CRAs. These 
five dijquite tyi>es are describerl as: 

• Claims account has been closed; 

• Dispute present or previous account status, payment Mstory, or 
payment rating; 

• Dispute ciurent balance; 

• Dispute related to disposition of account included in or excluded from 
a bankruptcy; and 

• Not my acr:ount. 

Although CDIA could not provide a definitive ranking for all five types of 
disputes, it did state that '‘not my account” was the most frequently 
received dispute. After receiving a consumer’s dispute, FCRA requires a 
CRA to conduct a rcinv'cstigation. The purpose of rcinv'cstigation is to 


“This study found that 1,223 of their .sample of lo,7ft3 consmiiei’s who were denied credit 
had requested their credit reports. Of those that had requested their credit reports, 304 
consumers found and disputed errors. At the. time of the study, 36 of those disputes had 
resulted in a reversal of the original negative credit decision. 
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either verify the accuracy of tl\e disputed mfonuation, or to confirm and 
remove an error. 

C)T)TA pro\ided data on the disposition of dispute reinvestigations by 
categories of those received by the three major CRAs in 2002. CRA 
officials explained that the data represents the first 3 quarters of 2002, and 
that each CRA reported data on a differenL quarter. CDIA declined to 
provide the total number of consumer disputes. Table 1 sliow s the 
frequency of these four disposition categories. Specifically, the table 
indicates that over half of all disputes required the CRA to modify a credit 
report in some way, though not necessarily to remove an error. 


Table 1 : Disposition of Consunfter Disputes 

Result of Dispute 

Percent of Disputes 

Information verified as reported 

46 

Data modified/updated per furnisher’s instructions 

27 

Data deleted per furnisher's instructions 

10.5 

Data deleted due to statutory time limit 

16 


Souic». CDIA. 

Notes: As provided by CDIA. percentages do not total to 1 00. 


It is imporlaiu to emphasize that not every dispute leads to identifying an 
error. Indeed, many disputes, as the table indicates, resulted in a 
verification of accuracy or an update of existing information. Additionally, 
CRA and CDIA representatives stated that many disputes resulted in the 
CRA clarifying or explaining why a piece of information was included in 
Lite credit repoii. For example, if recently ntairied consumers obtained a 
copy of their files, tliey might not see their married names on file. In such 
cases, the files still accurately reflected the most current information 
provided to the CRA, but the consiuner may have perceived the less-than- 
current information as an error while the CRA would not. The CRA 
representative cited another example of a consumer seeing ait ac'count 


'"“Infonnation verified as reported" encompasses disputed information found to be 
accurate alter reinvestigation. “Data moditied/updated per furnisher’s instructions” 
encDmpas.ses dit^ited information that a CRA modified or updated after reinvestigafion. 
Accordiiig to CDIA, tlie iufurmation in tliis category was nut necessarily inaccurate, 'Data 
deleted per fumi^er’s instructions" encompasses infonnation identified as inaccurate 
through reinvestigation. “Data ddeted due to statutory time limit” encompasses 
iiifonnatio)i tliat a CRA had to delete because the reinvestigatioii process exceeded the 
time limits set by FCRA 
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listed with a creditor he or she did not recognize. However, the account in 
question was with a retailer that subsequently outsourced its lending to 
another company. In this case, the information was connect but the 
consumer was not aware of the outsonrc’ing. One CRA l epresentative 
indicated that over 50 percent of tire calls they received resulted in what 
tliey consider “<;(M»siiirier ediK’ation.” 


Literature and Industry We cannot determine the frequency of errors in credit reports based on 

Data Have Serious Consumer Federation of America, U.S. PIRG, and Consumers Uniori 

Limitations studies." TW'O of the studies did not use a statistically representative 

methodology because they examined oirly the credit files of tlieir 
employees who verified tlie accuracy of the information, and it was not 
clear if the sampling methodology in the third study was statistically 
projectable. Moreover, all three studies counted airy inaccuracy as an 
error regardless of the potential impact. Similarly, the studies used varying 
definitions in identifying errors, and provided sometimes obscure 
exidanations of how they (tar ried out their wor k. Because of this, the 
findings may not represent the total population of credit reports 
maintaine<l by the CRAs. Moreover, none of these gr oups developed their 
findings in consultation with members of the credit reporting industry, 
who, according to a CDIA representative, could have verified or refuted 
some of (lie claimed errors. 

Beyond these limiLaLions, a CDIA official slated Qial lliese studies 
misrepresented the frequency of errors because they assessed missing 
information as an error. According to CRA officials errors of omission may 
be mitigated in certain instances because certain lenders tend to use 
merged credit report tiles in makiiig lending decisions, such as mortgage 
lenders and increasingly credit card lenders. CRA officials explained that 
while complete and current data are necessaiy for a wholly accurate credit 
file, both are not always available to them. For instance, credit-reporting 
(fy(Jes, wliich dictate w'hen CRAs receive data updates from data 
furnishers, may affect the timeliness of data. CRAs rely on these updates, 
whic'h may come daily, weekly, or monthly depending on the data 
furnisher’s reporting cycle. If a data furnisher provided information oh a 
monthly basis there would be alag between a consumer’s payment, for 
example, and the change in credit file information. Likewise, if a data 


Fedeixd Iteserve Bullelin article did not adikcss Uic frequency oleri-ors, alLhougli it 
did discuss Cudii^ orinconsislcncies. 


GAO-03-1036T 



666 


furmslier reported to one CRA but not to anotlier, Llie two reports would 
differ in content and could produce different credit scores. It is important 
to note tliat reporting information to the CRAs is voluntary on the part of 
data furnishers. While the Federal Reserve Bulletin article noted 
inconsistencies as an area of concern, it recognized that all credit reports 
would not contain identical information. 

Along w'itli misrepresenting error frequency by coiintii\g omitted 
infoi'ination, iiulustry officials l)elieved that the literatuie misrepi'esente<l 
tlte frequency of errors because tl\e literature defined errors diTferenQy 
than the credit industry. Tlic CRAs aitd CDIA stated that they consider 
only thasc errors that could have a meaningful impact on a person’s credit 
worthiness as real errors. This distinction is critical to assessing accuracy, 
as, according to the CDIA, a mistake in a consumer’s name might literally 
be an inaccuracy, but may ultimately have no impact on the consumer. 

The data provided by CDIA and the CRAs have serious limitations as well. 
For exaittple, neither CDIA nor CEA officials provided ait explanation of 
Ute methodology for Uie collection of data provided by CDIA and for the 
assessments cited by the CRAs. Moreover, because these data related 
primarily to those errors that consumers disputed after an adverse action, 
they excluded a potentially lai^e population of errors. Specifically, these 
data excluded errors that would cause a credit grantor to offer less 
favorable teriiLs on a loan rather than deny the loan application. The data 
also excluded eiToi*s in cases where consumers were not necessarily 
seeking a loan and therefore did not have a need to review their credit 
reports. Additionally, as .stated earlier, only a small percentage of 
consumers requested credit reports simply out of curiosity. Wliile tlie 
CDIA representatives felt that these data were useful for assessing a level 
of accuracy, they agreed that by focusing on these data only, the industry 
did not consider a potentially large set of errors. 


Both Literature and While both the literature and credit industry representatives cited similar 

Industry Identified Similar types and causes of errors, neither the literature nor tlie credit industry 

Types and Causes of identified one particular type or cause of error as tlie most conuuon. 

Errors ^ respondents stated tliat error type could range from wrong names and 

incorrect addresses to inaccurate account balai\ccs and erroneous 
information from public records. 

Based on tlie literature we reviewed and on our discussions with CRA and 
data furnisher officials, W'e couhl not identify any one cause or source 
most responsible for errors. Howevei’, the Consumer Federation 2002 
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Study, the P>deral Resen^e IJiilletin article, and a representative from the 
National FoiimJatioli for Credit Counseling stated they felt data fnrnishei's 
often caused more errors tlian did CRAs oi' consiiniei's. According to 
several respondents, tliis was particularly true for data furnishers, such as 
collection agencies and public entities that did not rely on accurate credit 
reports for lending decisions. For example, while a bank needs accurate 
mfomiation in assessing lending risk, and thus attempts to report accurate 
mfomiation, a collection agency does not rely on credit reports for 
business decisions, and therefore has le&s of ati incentive to report fully 
accurat.e information. Data furnisheis n)ld us that they did not cx)nsider 
CRAs as a signillcanl cause of errors, but stated tl\at difficulty m matchhig 
consumer identification information miglit cause some errors. Data 
furnishers also stated that the quality control efforts among data 
fuinisbeis miglit vary due to tlie extent of data integr ity procedur es in 
place. TIrey explained that some smaller data furnishers might r\ot have 
sophisticated quality control procedures because implementing such a 
system was expensive. 

On the oUter hand, errors might occur at any step in lire credit reporting 
process. Consumers could provide Inaccurate names or addresses to a 
data flirriislier. A data fiirriisher might introduce inactmiacdes while 
processing irifonuation, performing data entry, or passing infoririatiori on 
to the CRAs. And, CRAs miglit process data erroneously. Figure 1 shows 
some common causes for errors that might occur during the credit 
reporting process. 


Figure 1 : Common Causes of Errors In the Consumer Credit Report Process 



GAO-03-1036T 






668 


CRAs aiid data furnishers also citx^d other causes of errors. For example, 
collection agencies and public records on bankruptcies, tax liens, and 
judgments were cited as major sources of errors. CRA officials and data 
furnishers said the growing number of fraudulent credit “repair” chnics 
that coach consumers to make frivolous reinvestigation requests in an 
effort to get accurate, though negative, information off the credit report 
also might cause errors, as disputed information a CRA cannot verify 
within 30 days is deleted from the consumer’s credit report. File 
segregation, a tactic in which a consumer with a negative credit histoiy 
tries to create a new credit file by applying for credit using consistent but 
inaccurate information, was another reported cause for inac^cniiate caedit 
data. 


Industry Has Implemented 
Procedures to Ensure Data 
Consistency and Accuracy, 
but Efficacy of Procedures 
Not Known 


The cre<lit industry has been working on systems to help ensure a(K;ura(y 
since tlie “reasonable procedures” standard took effect under FCRA in 
1970. Within the last decade, CDIA has led efforts to implement industry 
systems and processes to increase tlie accuracy of credit reports. In 
conunenting upon accuracy, representatives from CDIA, tlie CRAs, the 
Federal Reserve, and the data furnishers staled tlial credit score models 
were highly calibrated and accurate and, on the aggregate level, credit 
reports and scores were highly predictive of credit risk.*' 


During the 1970s, the Associated Credit Bineaus (how CDIA) attempted to 
increase report accuracy by introducing Metro 1, a method of 
standardizing report formats. The goals of Metro 1 were to create 
consistency in report ing rules and impase a data template on the industry. 
Ill conjunction with the industry, in 1996 CDIA created Metro 2, an 
enhancement of the Metro 1 format that enables a finer distinction for 
reporting infonnation. For example, Metro 2 allow’ed CDIA to implement 
an “Active Military Code” to protect The credit reports of troops serving 
overseas. Since active military personnel are legally entitled to longer 
periods h) make (rredit payments without penalty, tliis new code ensured 
that data funushers did not incorrectly report accounts as delinquent. 


Wliile use of the Metjo format is voluntary, CRAs cur rently receive over 99 
percent of the volume of credit data — 30,000 furnishers providing a total of 


'^Hecaiise many credit grantors are also data ftn-nishers, it is generally in their best interest 
to rejfort. accurate infonnation to the CRAs, as they rely on credit reports received from the 
CRAs in assessing risk. Likewise, the CRAs depend on ensuring accuracy in their credit 
reports in order to proride a quality product to their custunieis, the credit grantors, 
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2 billion records per month — in eitl\er Metro 1 or Metro 2 format, with 
over 50 percent sent in Metro 2. One data rmnisher wiio recently switched 
from Metro 1 to Metro 2 found that data accuracy improved overall as 
evidenced by the reduction in the number of data rejections by the CRAs 
and dispute data. Those data furnishers that do not use the Metro formats 
provide data on compact disc, diskette, tape, or other type of electronic 
media. Wliile use of standardized reporting formats ensures more 
consistent reporting of information, because tlie industry lias never 
conducdrid a study to set a liaseUne level of error frequency in creilit 
reports, and does not currenQy collect such data, no one knows the extent 
to which these systems have improved accuracy in credit reports. 


FTC Has Taken 
Enforcement Actions 
Related to the Accuracy of 
Credit Reports Since 1996 
PCRA Amendments 


PTC has taken eight formal enforcement actions since the passage of the 
1996 FCRA amendments against CRAs, data furnishers, and resellers that 
dire<dly or indirectly relate to cre<iit report a(!(;ura(ty.'^ FTC re(!eives and 
tracks FCRA complaint dala against CRAs by violation type and uses tliis 
data to identify areas that may warrant an enforcement action. While these 
data cannot provide tlic luunber of violations or frequency of errors in 
credit reports, since each complaint does not necessarily correspond to a 
\aolation, they can give a sense of the relative frequency of complaints 
surrounding CRAs. W'e discuss complaint data in more detail in the next 
section. 


According to FTC staff, accuiacy in tlie context of FCRA means more titan 
the requirement that CRAs establish “reasonable procedures to assure 
maxiiTumi possible accuracy of their reports.” They explained that the 
statute also seeks to improve accuracy of credit reports by a “self-help” 
process in which the different participants comply with duties imposed by 
FCRA. First, credihas and others that furnish information are responsible 


’■‘Prior to 1996, FTC earned out actions Involving procedures to ensure the accuracy of 
credit reports against Ti-aiisUnion in 1983, TRW (whidl would later become Experiaii) in 
1991, and Equifax in 1995. According to FTC, these “omnibus” actions differ'ed in detail but 
generally covered avariefy of hX!RA is-sues including accuracy, disclosure, permissible 
purposes, and prescreening. While we limited this rertew to ITC’s accuracy-related efforts, 
we are currently conducting additional work as part of another ongoing engagement 
looking at FTC and die banking regulator's etrforcement of FCRA. A number of other 
federal agencies have responsibilities under KCRA incUidi'ng the Office of the Comptroller 
of the Cuirency, Federal Reserve Boaixi, Office of Thrift Supervision, National Credit Union 
Administration, Federsd Deposit Insurance Corporation, Department of Transportation, and 
Dcpartjncnt of Agriculture. Each entity can pursue FCRA enforcement actions against their 
respective regidated institutions as klentined in FCRA 
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for accuracy. Second, credit bureaus must take reasonable steps to ensute 
accuracy. Finally, users of credit reports must notify consumers (provide 
adverse action notices) about denials of a loan, insurance, job, or other 
services because of something in their credit report. FTC staff stated that 
it is crucial tliat consumers receive adverse action notices so that they cai\ 
obtain Omir credit reports and dispute any inaccurate information. For 
that reason, the Commission has made enforcement in this area a priority. 

FTC staff stated that their primary enforcement mechanism is to pursue 
action against aCRA or data furnisher that showed a pattern of repeated 
violations of the law identified through consumer complaints. According 
to FfC staff, the Commission has taken eight enforcement actions against 
CRAs, furnishers, or lenders, since 1996 that directly or indirectly 
addressed credit report accuracy.'^ One case pertained to a furnisher 
providing inaccurate infonnation to a CKA, two cases pertained to a 
furnisher or CRA failing to investigate a consumer dispute, and two 
actions were taken against lenders tliat did not provide adverse action 
noti(;es as l eiiuued by statute. The I'emaining three cases were against the 
mjyor CRAs for blocking consumer calls and having excessive hold times 
for consumers calling to dispute infonnation on their credit reports.'' In 
addition to enfoicing FCEIA, FTC also provides consumer educational 
materials and advises c onsumers on tiiek riglits (such as the light to sue a 
CRA or (lata fiiniisher for damage^s and rec^oup legal expenses). 


’*The eight rases are First .■\merican Real Estate Solutions LLC, Docket No. CilSdP (1999); 
U.S. V. Uiiicor Funding, Inc.. Qv. No. 99-1228 (C.D. Cal. 1099);. U.S. V. Equifax, Nol:00 CV- 
0087 (C.D. Ga. 2000); U.S. v. Expcriati, No. a-0OCV0O56-L (N.D. Tex. 2000); U.S. v, 
TraiisUnioii, OOC 02-:^ (N.D. Ifl. 2000); U.S. v. Pcrformajicc Capital ManagcinoiU, Inc., No. 
01-1047 (C.D. Cat 2001); U.S. v. DC Credit Sere. Inc., Civ. No. 02-511o (C.D. Cal. 2002); 
Quicken Loaits Inc. Docket No. 9304 (i\pr. 8, 2003). 

' FTC lias also investigated landlord's compliance \vith their duty to provide FCRA required 
notices to consuniers who suffered adverse action based on tlieir consumer reports in 
connection with apartment rental applications. The Coiranission did not bring any formal 
actions, but published a consumer alert and a bitsiness education brochure for landlords 
That resulted from this enforcement effort. 
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Impact of 1996 FCRA 
Amendments on 
Credit Report 
Accuracy and the 
Potential Effects of 
Errors on Consumers 
Is Not Fully Known 


To date, no comprehensive assessments have addressed the impact of the 
1996 FCRA credit rejfoit, acciiraciy aitieiuiinents or the potential effects 
inaccuracies have had on consumers. In addition, because it lias not 
conducted surveys, KPC was not able to provide overall trend data on the 
frequenc*y of errors in credit reporte. Industry officials as weU as two 
studies we reviewed suggest tliat errors and inaccuracies in credit repoits 
have the potential to both help and hurt individual consumers, while in 
some instances errors or inaccuracies may have no effect on the 
consumer’s credit score. The impact of any particular error or inaccuracy 
in a particular credit report will be dependent on the unique and specific 
circumstances of the consumer. 


Information on the Impact 
of FCRA Amendments on 
Credit Report Accuracy 
Was Not Available 


Data on the impac t of Uie 1996 FCRA amendments on credit report 
accmacy was not available. For instance, we could not identic^ impact 
information from the literature we reviewed and industry officials with 
whom wc spoke said tlicy did not collect such data. Ftutlicrmoro, FTC 
could not provide overall trend data but did provide FCRA-related 
consumer complaint data involving CRAs. 


FTC staff could not say what, the trend in the frequency of errors in credit 
repoits has been since the 1996 amendments because tliat data is not 
available. However, FTC officials provided consumer complaint data that 
shows from 1997 tluough 2002, the number of FCRA complaints involving 
CRAs received annually by FTC increased from 1,300 to almost 12,000. The 
most common complaints cited against C RAs in 2002 pertained to the 
violations are listed below: 


• Provided inaccurate information (5^956 complaints); 

• Failed to reinvestigate disputed information (2,300 complaints); 

• Provided inadequate phone help (1,291 complaints); 

• Disclosed incomplele/improper credit file to customer (1,033 
complaints); and 

• Improperly inducted reiiivestigation of disputed item (771 
complaints). 

Consumer complaint data involving GRAs and FCRA provisions represent 
3.1 percent of Uie total complaints FTC received directly from consiuucis 
on all matters in 2002. The FTC staff explained that their knowledge was 
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limited to complaints that came into the agency and that they did not 
conduct general examinations or evaluations that would enable them to 
project trends. FTC stall cautioned tltat it would not be appropriate to 
conclude that since the complaints against CRAs were on the rise, 
accuracy of credit reports was deteriorating. They stated that the increase 
in the number of complaints could be due to greater consumer awareness 
of FTC’s role witli respect to credit reporting, as well as a general trend 
towards increased consumer awareness of credit rcportiitg and scoring. 


Errors May Result in Both 
Positive and Negative 
Impacts on Consumers 


CRAs and tlie literature suggest that ca edit-i epoiting errors (•ould have 
botli a positive arul negative effec;t on c.onsumei-s. One CRA stated that 
errors occur randomly and may result in either an increase, decrease, or 
no change in a credit score. Another OKA stated that information 
erroneously omitted from a credit report such as a delinquency, judgment, 
or bairkruptcy filing would tend to raise a credit score wliile that same 
inforntation erroneously posted to the report would tend to lower the 
score. The Consumer Federation of America study cited earlier also 
analyzed 258 files to determine whether inconsi-stcncics were likely to 
raise or lower credit scores. In approximately half the files reviewed (146 
files, or 57 pei(reiit), the study c.ould not dearly identify whether 
inconsistencies in (rredit repoits were resulting in a liigher or lower score. 
The study determined that in tlte remaining 1 12 files tltere was an even 
split between files that would result in a higlter or lower score. The 
Federal Reserve Bulletin aiticle previously mentioned also concluded tltat 
limitations in consumer reporting agency records have the potential to 
both help and huit individual consuiiiers. The article fuither stated tliat 
consumei's who weie hurt by ambiguities, duplications, and omissioiis in 
Llieir files had an incentive to correct them, but consumers who were 
helped by such problems did not. 


Impact of Errors May Be Industiy officials and tlte liteiature we reviewed suggested that the impact 
Influenced by Other ^ error in a consumer's credit report was dependent on the specific 

Factors in a Credit File circimistancc of the infomiation contaiitcd in a credit file. CRA and data 
furnisher officials further pointed out that a variety of factors such as 
those identified by Fair Isaac, a private software finn that produces credit 
s(;oi e models, might impact a credit score."'’ According to the Fair Isaac 


^^air Isaac C<irporation produce software used by many consumer reporting agencies, 
including the three ttiain U.S. cotisuraer ?^»etlcies, to produce FICO scores, which according 
to industiy sources, is a coiiunonly used credit score in tlie United States. 


GAO-03-1036T 




673 


Observations 


Web site, their credit score model considers five main categories of 
information along willi their general level of iniporlance Lo arrive at a 
score. Tliese categories and then' respective weiglits in determiniitg a 
credit score include p^ment history (35 percent), anioinits owed (30 
percent^, leiigtii of credit history (15 percent), tyjtes of ctredit in use (10 
percent) and new Credit (10 percent). As such, no one piece of information 
or factor alone determines a credit score. For one person, a given factor 
might be more important than for someone else with a different credit 
history. In addition, as the Information in a credit report changes, so does 
the importaiice of any factor in determining a ciedit score. Fully 
understanding the impact of crrois on consumer’s credit scores would 
require access to consumer credit reports, discussions with consumers to 
identify errors, and discussions with data furnishers to determine what 
impact, if any, coiTectioti of errors might have on decisions made based on 
tlie content of a credit report. 


The lack of comprehensive information regarding the accuracy of 
consumer credit reports inliibils any meaiungful discussion of what more 
could or should bo done to improve credit report accuracy. Available 
studies suggest that accuracy could be a problem, but no study has been 
performed that is representative of the universe of credit reports. 
Fuithennore, any such study would entail the cooperation of the CRAs 
data furnishers, and consumers to fully assess tire impact of errors on 
credit scores and undeiwuiting decisions. Because of the importance of 
accurate credit reports to the fairness of our national credit system, it 
would be useful to perform an independent assessmerrt of the accuracy of 
credit reports. Such an assessment could be conducted by FTC or paid for 
by the industry. The assessment would then tbiTU the basis for a more 
complete and productive disciis.sion of the costs and benefits of making 
changes to the current system of credit reporting to improve credit report 
accuracy. 

Anotlier option for improving the artcuracy of credit reports would be hr 
create the opportunity for more reviews of credit reports by consumers. 
One way this could be accomplished would bo to expand the definition of 
what constitutes an adverse action. Cun'ently, consumei“S are only entitled 
to receive a free copy of their credit reports when they receive adverse 
action notices for credit denials or if tliey believe tliat they have been the 
victim of identity theft When consumers sec their credit reports, they have 
a chance to identify errois and ask for corrections to ensure the accuracy 
of their credit reports. Expanding the criteria for adverse actions to 
include loan offers witli less tlian tlie most favorable rates and terms 
would likely increase the review of credit files by consumets. Such added 
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review of credit files would in all likelihood help to further ensure the 
overall accuracy of consumer credit reports. However, tlie associated 
costs to die industry would also need to be considered against; tlie 
anticipated benefits of increasing consumer access to credit reports. 


anti fiudier information regarding diis testimony, please contact Harry 

out itctc cU lU Medina at (415) 904-2000. Individuals making key contiibutions to this 

Acknowledgement statement include Jmiet Fong, Jeff R. Pokras, Mitchell B. Rachlis, and 

Peter E. Rumble. 


GAO-03-1036T 



675 


WORKING PAPER NO. 02-21 
THE DEVELOPMENT AND REGULATION 
OF CONSUMER CREDIT REPORTING IN AMERICA 


Robert M. Hunt* 

Federal Reserve Bank of Philadelphia 
November 2002 


Research Department, Federal Reserve Bank of Philadelphia, Ten Independence Mall, Philadelphia, 
PA 19106. Phone: 215-574-3806. Email: bob.hunt@phil.frb.oi^ 

This paper has benefited from comments on earlier drafts by Mitchell Berlin, John Caskey, Satyajit 
Chatterjee, and seminar participants at Riksbank. The paper has also benefited from comments and 
contacts provided by the bank’s Payment Cards Center. Any remaining errors are my own. 

The views expressed here are those of the author and do not necessarily represent the views of tlie 
Federal Reserve Bank of Philadelphia or the Federal Reserve System. 



676 


THE DEVELOPMENT AND REGULATION 
OF CONSUMER CREDIT REPORTING IN AMERIC A 

Robert M. Hunt 

Federal Reserve Bank of Philadelphia 
October 2002 

Abstract 

In the United States today, there is at least one credit bureau file, and probably three, for 
every credit-using individual in the country. Over 2 billion items of information are 
added to these files every month, and over 2 million credit reports are issued every day. 
Real-time access to credit bureau information has reduced the time required to approve a 
loan from a few weeks to just a few minutes. But credit bureaus have also been criticized 
for furnishing erroneous infoimation and for compromising privacy. The result has been 
30 years of regulation at the state and federal levels. 

This paper describes how the consumer credit reporting industry evolved from a few joint 
ventures of local retailers around 1 900 to a high technology industry that plays a 
supporting role in America's trillion dollar consumer credit market. In many ways the 
development of the industry reflects the intuition developed in the theoretical literature on 
information-sharing arrangements. But the story is richer than the models. Credit 
bureaus have changed as retail and lending markets changed, and the impressive gains in 
productivity at credit bureaus are the result of their substantial investments in technology. 

Credit bureaus obviously benefit when their data are more reliable, but should we expect 
them to attain the socially efficient degree of accuracy? There are plausible reasons to 
think not, and this is the principal economic rationale for regulating the industry. An 
examination of the requirements of the Fair Credit Reporting Act reveals an attempt to 
attain an appropriate economic balancing of the benefits of a volimtary information- 
sharing arrangement against the cost of any resulting mistakes. 


JEL Codes: D82, G21 , G28, N22 

Keywords: Consumer credit reporting, credit bureaus, information sharing. Fair Credit 
Reporting Act 
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I. Introduction 

Consumer credit bureaus are organizations that compile and disseminate reports on the 
creditworthiness of consumers. Firms that lend to consumers provide the underlying data 
to the bureaus. In the United States today, there is at least one credit bureau file, and 
probably tliree, for every credit-using individual in the country. Over 2 billion items of 
information are added to these files every month, and over 2 million credit reports are 
issued every day. In many instances, real-time access to credit bureau information has 
reduced the time required to approve a loan from a few weeks to just a few minutes. 

A consumer credit report typically includes four kinds of information.’ First, 
there is identifying information such as die person’s name, current and previous 
addresses, social security number, date of birth, and current and previous employers. 
Next, there is a list of credit informadon that includes accounts at banks, retailers, and 
lenders. The accounts are listed by type, the date opened, the credit limit or loan amount, 
outstanding balances, and the timeliness of payments on the account. There may also be 
information gleaned from public records, including bankruptcy filings, tax liens, 
judgments, and possibly arrests or convictions. The file will typically include a count of 
the number of inquiries authorized by the consumer but will not contain any information 
about applications for credit or insurance that were denied. 

Today Americans hold more than 1 .4 billion credit cards, use them to spend $1 
trillion a year, and maintain balances in excess of $600 billion.^ Information provided by 
credit bureaus is an important ingredient in the vast expansion of unsecured consumer 
credit in tlie U.S. over the last century. This information is used to decide who is offered 
credit and on what terms. Credit bureau data are used to monitor fraud. The existence of 
credit bureaus is an inducement to honor one’s debts. Information shared through credit 
bureaus can increase competition among providers of financial services, resulting in more 
credit offered on better terms. 

But this does not mean that private credit bureaus necessarily maximize social 
welfare. There are plausible reasons why credit bureaus may make more mistakes than 
would otherwise be efficient. Nor would their choice of the relative frequency of 
mistakes (including inaccurate derogatory information vs. excluding positive 
information) necessarily be efficient. In the U.S., credit bureaus have a tarnished 
reputation and are subject to regulation at the federal and state levels. The regulatory 
regime adopted in the U.S. was clearly shaped by an attempt to balance the social 


' This paper focuses on what the Fair Credit Reporting Act (FCRA) calls consumer reports and 
not investigative consumer reports. The latter are sometimes used for employment, insurance, and other 
decisions, are based in part on information gathered from personal interviews, and ai'e governed differently 
under the FCRA. Investigative reports engendered significant controversy in the late 1960s and early 
1970s, in part because consumers were not always informed they were being done or that information 
based on them was maintained in credit bureau files. See Miller ( 1 97 1 ) and the Privacy Protection Study 
Commission (1977). 

" These numbers, for 1 999, are from HSN Consultants and The Nikon Report, as reprinted in the 
Statistical Abstract of the U.S: 2001 . 
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benefits and costs of information sharing. Whether that balance can be improved upon is 
the subject of ongoing debate. 

The remainder of this paper is organized as follows. Section II reviews the 
relevant literature on voluntary information-sharing arrangements. Section III describes 
how consumer credit reporting evolved in the U.S. over the last century in response to 
legal, economic, and technological changes. Section IV examines the most commonly 
articulated rationale for regulation of the industry — inadequate precaution with respect to 
consumer privacy and the accuracy of data contained in credit files. Section V review's 
the American scheme for regulating the industry. Section VI concludes by examining 
two of the leading challenges facing the industry in the U.S. — the possibility of more 
stringent regulation and ongoing consolidation in the credit card industry. 

11. The Economics of Information Sharing 

Adverse selection is an important problem in the market for unsecured credit in the U.S. 
Ausubel (1999) found that individuals who responded to a given credit card solicitation 
were, on average, worse credit risks than those who did not respond. Also, customer 
pools resulting from credit card solicitations offering inferior terms (e.g., higher interest 
rates) had a higher average risk of default than pools resulting from solicitations offering 
better terms.^ 

Ausubel’s earlier finding that credit card rates in the U.S. are sticky — i.e., they do 
not change very much in response to a change in banks’ cost of funds — can be interpreted 
as another indicator of adverse selection (Ausubel 1991). If lenders respond through 
credit rationing, marginal increases in the supply of loanable funds would not reduce 
interest rates until the excess demand is entirely eliminated (Stiglitz and Weiss 1981).’' 

The significance of moral hazard in credit card markets is, of course, a central 
topic in the ongoing debate over bankruptcy reform in the United States. Throughout 
2001-02, credit card delinquency and charge-off rates, as well as the consumer 
bankruptcy rate, were at or near record highs. Empirical research suggests that many 
factors contribute to bankruptcy filings (Sullivan et al. 2000), and some economists 
wonder why Americans do not file more than they do (White 1998).'’’ 

Credit bureaus mitigate adverse selection and moral hazard problems by 
providing timely information about the characteristics and behavior of potential 
borrowers. Because that infonnation is retained for a considerable time (seven years for 
most derogatory credit information in the U.S.), credit bureaus enable the maintenance of 
reputation effects in a market consisting of millions of otherwise anonymous borrowers 


’ Additional empirical evidence is found in Calem and Mester (1995). 

Adverse selection can lead to sticky prices through mechanisms other than credit rationing. For 
example, Mester (1994) describes how reductions in banks’ costs of Hinds may result in an increase in the 
average riskiness of credit card borrowers. 

’ For reviews of the recent literature, see Congressional Budget Office (2000) and Mester (2002), 
The latter article contains a plain English description of the proposed bankruptcy reform legislation. 
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(Klein 1997). In the U.S. at least, credit bureau data can be used to generate lists of 
consumers who are offered pre-approved lines of credit (pre-screening). The availability 
of data on a universe of credit users also makes it possible to develop sophisticated 
models to select and price credit risk for unsecured consumer loans. 

A. Intuition from Economic Theory 

Given the evident benefits to lenders, it seems natural to expect information sharing to 
emerge as soon as an efficient mechanism for coordinating this process, the credit bureau, 
was developed. In the U.S. and certain other countries that is exactly what happened. 

But credit bureaus do not always emerge, and in some instances, they were instead 
legislated into existence. What explains the emergence of credit bureaus or their failure 
to emerge? 


1 . The Severity of the Information Problem 

The benefit to a lender of joining a credit bureau depends in part on tbe unobserved 
heterogeneity of its potential customers. Information sharing becomes more attractive 
when good customers are harder to find, which diverts resources toward finding good 
customers rather than serving them. In that case, it becomes relatively more efficient to 
pool information than for each firm to generate it (Wilson 1 990). 

The incentive to join a credit bureau will depend on how frequently lenders 
expect to encounter new potential borrowers and the nature of competition among 
lenders. The number of new potential borrowers should clearly depend on the geographic 
mobility of consumers and possibly the geographic reach of a lender’s operations. As for 
competition, consider two possible lending environments — one in which consumers do 
all their borrowing from a single lender and one where borrowers are able to obtain loans 
from many different lenders. In the latter case, lenders would clearly be willing to incur 
some expense in order to obtain a better idea of a borrower’s total indebtedness, both 
before and after making a loan. 

2. Costs 

Another obvious factor is the cost associated with establishing and maintaining a credit 
bureau. These costs may be prohibitive if the fixed costs are high and relatively little 
lending is going on. But these costs become easier to absorb when lenders are making a 
higher volume of loans. The volume of consumer lending also affects the information 
advantage that a credit bureau enjoys over the information held by any given lender. 

Another reason that the volume of lending matters is that when there is a high 
volume of applications for loans of modest size, relative to business loans, for example, 
lenders carmot afford to invest a lot of resources evaluating each loan application. Once 
established, a credit bureau can help lenders to substitute more costly screening 
techniques (credit scoring) with timely credit history information without incurring an 
unacceptable increase in overall credit risk. These techniques need not depend on the 
information contained in one lender’s files. Rather, they are often refined and calibrated 
using credit history information gathered from all participating lenders (e.g., FICO 
scores). 
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3. Network Effects 

There is clearly an element of network effects with credit bureaus. Obviously, credit 
bureaus become more useful to lenders as the coverage of potential customers increases. 
A credit bureau with better coverage of lenders is more highly valued because any lender 
that relies on the bureau’s data can be more confident it knows the totality of a 
bon-ower’s credit activity. Both of these mechanisms can mitigate adverse selection. 

They may also reduce moral hazard if borrowers are aware that their credit lines and 
payment history are reported by, and can be disclosed to, a larger share of potential 
creditors, finally, additional membership helps to amortize a bureau’s fixed costs. 

These factors suggest the possibility of multiple equilibria. Without some form of 
coordination, a credit bureau may not attain a sufficient scale to be self-sustaining. But if 
a sufficient scale is reached, bandwagon effects might easily lead to universal 
membership. In that case, when we observe credit bureaus v/e would expect to observe 
only a few of them, perhaps only one, serving a particular market. 

But network effects may not be so strong as to imply universal participation by 
creditors or a monopoly credit bureau. For example, there may be a point where 
increases in credit bureau membership yields relatively little new information but creates 
more competition for a relatively fixed pool of borrowers (Wilson 1 990). Alternatively, a 
lender that is more worried about moral hazard than adverse selection may be tempted 
not to join the credit bureau, essentially free-riding on the deterrent effect created by the 
information sharing of its fellow lenders. This is less likely as the cost of participating in 
a credit bureau falls. Finally, creditors may choose to share information with more than 
one bureau in order to stimulate competition and innovation for such services. 

4. Market Structure 

Suppose for the moment that we can treat market structure and the intensity of bank 
competition separately. In a more concentrated lending market bank, a given bank will 
have information about a larger share of the universe of borrowers than would a bank in a 
less concentrated market (Marquez 2001 ). That suggests credit bureaus may enjoy a 
larger informational advantage over individual banks when lending is less concentrated. 

Two additional arguments can be made. First, when there are many lenders, they 
are likely to be more concerned about the current indebtedness of any prospective 
borrower. To the extent that subsequent indebtedness may reduce the likelihood that 
existing loans will be repaid, lenders will also be concerned about any additional 
borrowing done by their existing customers.* That suggests we should expect credit 
bureaus to emerge more often when there are more lenders, each of whom accounts for a 
smaller share of the borrowing population. 


* Shaffer (1998) posits an another argument that is relevant here — the winner’s curse associated 
with being the lender who grants a loan to a borrower previously rejected by many other banks. 
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5. Competition 

Now we turn to the question of competition among lenders. A number of papers (Wilson 
1990, Pagano and Jappelli 1993) suggest that more competition reduces the likelihood 
that lenders will join a credit bureau because doing so reduces the information asymmetry 
between a borrower’s current lender and its competitors. The question is whether a bank 
can earn enough profits on customers it attracts from other lenders to offset the decline in 
profits that results from having to offer more competitive terms to its existing customers. 
If the only barrier to competition is the lack of information on rivals’ customers, 
establishing a credit bureau might reduce profits. In that case it is less likely that 
information sharing would be voluntarily adopted by the industry. 

Padilla and Pagano (1997) suggest another possible inducement to the formation 
of credit bureaus. If banks can extract significant rents from bon'owers and cannot 
commit to avoid this, borrowers may have too little incentive to avoid default. In this 
environment, disclosing information about one’s borrowers is a way to commit not to 
extract too much rent. Banks will agree to share information if they gain more by 
reducing the default rate than they lose in profits on loans that would otherwise be repaid. 

But information sharing need not be a discrete choice. It is possible these 
tradeoffs could result in an equilibrium where some, but not all, information about 
customers is shared. For example, lenders might share only negative information about 
their customers — delinquencies and defaults — but not positive credit information such as 
the size of a credit line, its utilization, or other information relevant to a customer’s 
ability to repay. If s possible that by sharing some information, lenders could benefit 
from a reduction in adverse selection without losing too much profit. 

A number of papers show that disclosing limited information may be superior to 
disclosing all available information about borrowers. In Padilla and Pagano (2000) there 
is a tradeoff between the benefits of reducing adverse selection via full disclosure and 
reducing moral hazard by limiting disclosure, which induces borrowers to signal their 
type by avoiding defaults. The result is more lending, at lower interest rates, and with 
less frequent defaults than a policy of sharing all available information. In 'Vercammen 
(1995), a similar intuition can be used to justify limiting the length of borrowers’ credit 
histoiy', a practice regularly observ'ed in the credit reporting industry.^ 

B. Credit Bureaus in the Real World 

How well do the preceding theoretical arguments explain w'hat we observe about credit 
bureaus in the U.S. and abroad? The answer is that, even with the relatively limited 
empirical evidence available, the theory seems to explain a lot. Credit bureaus tend to 
emerge in countries where people are relatively mobile and, to a lesser extent, where the 
ratio of consumer borrowing to consumption is higher (Pagano and Jappelli 1993). The 
relationship between these variables and the annual per capita volume of consumer credit 
reports is even stronger. 


’ Such limitations are usually imposed by law and typically apply only to derogatory credit 
information. 
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In most developed countries, only a handful of credit bureaus are responsible for 
generating the vast majority of credit reports, and at least one of those bureaus will enjoy 
nearly complete coverage of consumers who borrow money (Jappelli and Pagano 1999), 

It appears that credit bureaus are more likely to emerge as a joint venture of local retailers 
or lenders than they are from collaborations of firms with a national reach (Pagano and 
Jappelli 1993). But once a credit bureau is created, its scope tends to grow with the scope 
of its members (see section II). In addition, bureaus that evolved in this way tend to 
share more positive credit information than bureaus initially established to serve lenders 
with a national reach. 

In several developed coxmtries, the sharing of consumer credit information did not 
exist until it was mandated by law. In these countries, the volume of consumer credit 
tended to be smaller, and there were fewer regulatory restrictions limiting competition 
between lenders (Pagano and Jappelli 1993). These patterns are consistent with the 
argument that voluntary information sharing is more difficult to initiate when doing so 
might contribute to intense competition among lenders, but that once established, credit 
bureaus enjoy significant network effects. 

Can we quantify the benefits that consumer credit bureaus provide? A lower 
bound of the gross benefits should be reflected in the revenues earned by credit bureaus 
and firms such as Fair, Isaac and Co., which develop scorecards for consumer loans. For 
the U.S., this lower bound is at least several billion dollars (see section II). McCorkell 
(2002) argues that using scorecards built with data supplied by credit bureaus results in 
delinquency rates 20-30 percent lower than lending decisions based solely on judgmental 
evaluation of applications for credit. Conversely, holding the expected default rate 
constant, using scorecards yields a comparable increase in the acceptance rate,* 

If we suppose for the moment that this technology disappeared and that lenders 
did not adjust the volume of their credit card lending, a simple estimate of the resulting 
increase in loan losses for the U.S. would be about $5 billion a year. Conversely, 
suppose that lenders responded to the loss of this technology by trying to hold the 
delinquency rate constant. The resulting decline in outstanding revolving loans would be 
about $120 billion.'^ These obviously crude calculations bound a region of potential 
gains, as banks would obviously adjust to any change in their screening technology. 

III. The Evolution of the American Consumer Credit Reporting Industry 

Consumer credit bureaus emerged in the United States in the late 19* century. Other 
early adopters include Austria, Sweden, Finland, South Africa, Canada, Germany, and 


* See also Chandler and Parker (1989) and Chandler and Johnson (1992). 

^ This number is 20 percent of the productof the charge-otT rate on banks’ credit card loans (4.38 
percent) times outstanding revolving credit ($613 billion) in the first quarter of 2000. That was the recent 
low for delinquencies and chargeoffs on U.S. banks’ credit card loans. The delinquency and charge-off 
rates were nearly identical at the time. See Barron and Staten (200 1 ) for a comparable exercise in which 
they ask what would be the decline in the discriminatory power of a scorecard when it is constructed only 
with derogatory credit information. Jappelli and Pagano (1999) use a cross national sample with 
macroeconomic data to identify some preliminary evidence of the effect of credit bureaus on default rates. 



683 


Australia (Jappelli and Pagano 1999). In the U.S., most of the early credit bureaus were 
cooperatives or nonprofit ventures set up by local merchants to pool the credit histories of 
their customers and to assist in collections activities. Others were established by local 
finance companies or the local chamber of commerce (Cole and Mishler 1998). 

The next step for this industry was the formation of a mechanism to share 
consumer credit information in different cities and regions of the cormtry. This was 
accomplished through a trade association established in 1 906. For most of its existence 
this organization was known as Associated Credit Bureaus, Inc., or ACB.’® ACB 
developed the procedures, formats, and definitions that enabled the sharing of credit files 
between agencies across the country. ACB even introduced a form of scrip, which 
members purchased from the association, which was used as a currency to pay for credit 
reports obtained from fellow members in other cities. 

Membership in ACB grew rapidly from fewer than 100 bureaus in 1916 to 800 in 
1927, and doubling again by 1955. According to ACB, its members collectively attained 
universal coverage of consumer borrowers by 1960. But even in that year, the largest of 
the credit bureaus maintained files on consumers in at most a handful of cities. At a time 
when the technology was limited to filing cabinets, the postage meter, and the telephone, 
American credit bureaus issued 60 million credit reports in a single year. 

A. Credit Bureaus Respond to Economic and Technological Change 

Credit bureaus emerged at a time when the primary source of consumer credit was 
offered by retailers; the other important sources were pawnbrokers, small loan 
companies, and, of course, friends and family. One reason that retailers were so 
dominant in this period was that state usury laws made it difficult to earn profits on small 
loans lent at legal rates (Caldor 1999, Gelpi and Julien-Labruyere 2000). 

Retailers, on the other hand, were able to earn a profit because they simply 
charged more for goods purchased on credit. This advantage became less important after 
1916 when many states relaxed their usury laws. Even so, in 1929 retailers financed one- 
third of all retail sales. Among retailers who offered credit, credit sales accounted for a 
little more than half of their sales.'* 

The share of retail sales carried on open accounts — a form of revolving credit — 
ranged from 20-22 percent in the business censuses conducted from 1929 to 1 948. In 
1935, open account sales represented 21 percent of sales at food stores, 19 percent at 
clothing stores, 26 percent at department stores, 24 percent at furniture stores, 22 percent 
at gas stations, and 52 percent at fuel and ice dealers. But the share of sales accounted for 


'“This association was originally called the National Federation of Retail Credit Agencies. Today 
it is called the Consumer Data Industry Association, or CDIA, but I will refer to its historic name 
throughout this paper. Some of the infoimation presented in this section is drawn from the organization’s 
web site. 

' ' These numbers exclude credit arranged through separate finance companies. For details on the 
historical statistics cited in this section, see the Data Appendix. 
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by installment contracts financed by retailers declined from 13 percent in 1929 to less 
than 6 percent in 1948, as finance companies and banks took up more of that business. 

Over the course of the last century, credit bureaus benefited from the increasing 
importance of consumer credit in the economy, but they also had to adapt to changes in 
the market for consumer credit. In the half-century beginning in 1919, consumer credit 
grew four times more rapidly than did total consumer spending. But consumer credit 
held by retailers grew only as rapidly as consumer spending. As a result, the share of 
consumer credit held by retailers fell by half (from 80 percent to 40 percent) between 
1919 and 1941. By 1965, it had fallen by nearly half again (Figures 1 and 2)P In 2000, 
nonfinancial businesses held only 5 percent of outstanding consumer credit. Thus, the 
rapid growth in consumer debt over this period did not wind up on the books of retailers, 
but rather on the balance sheets of financial institutions — ^primarily banks and finance 
companies. 

Another significant change in this period was that retail and consumer credit 
markets got bigger. At the turn of the century, for all but a handful of retailers and 
catalogue sellers, the market was limited to a single city or just part of a city. But this 
gradually changed. For example, regional or national department store chains accounted 
for less than 1 5 percent of department store sales in 1 929. By 1 972, they accounted for 
nearly 80 percent of sales. If we examine retail sales as a whole, which includes the sales 
of tens of thousands of independent restaurants and gasoline stations, the share of sales 
by regional or national chains rose from 13 percent in 1929 to 31 percent in 1972 (Figure 
3). Over time, larger chains removed their credit operations from individual stores and 
consolidated them at the headquarters. Membership and information sharing at the local 
credit bureau became less important while cooperation with the larger and more 
comprehensive credit bureaus became more important. 

For a long time, banks’ geographic expansion was constrained by restrictive 
branching laws. For consumer credit, however, branching restrictions became less 
important once bank-issued credit cards were introduced in the late 1950s and widely 
adopted in the late 1960s (Nocera 1994, Evans and Schmalensee 1999). Eventually, 
among the banks with the largest number of credit card accounts, the vast majority of 
these customers were not served through their traditional branch operations. 

Once credit cards offered by banks were widely adopted, many retailers opted to 
accept these cards while dropping their in-house credit programs. Many retailers, 
especially smaller ones, had offered credit plans simply to compete with other retailers. 
Merchants paid a price for accepting the bankcards — the merchant discount (6 percent of 
the purchase price at that time) — ^but they avoided other expenses, such as bookkeeping 
and collections activity, to say nothing of the cost of financing these receivables 
themselves. Larger retailers have maintained their store cards — even today there are 
more store card accounts than bankcard accounts, and the largest issuers include retailers 
such as Sears. In other instances, retailers have sub-contracted their store card operations 
to financial firms and no longer carry the receivables on their own balance sheets. 


’"To span the century, two sets of data are required. See the Data Appendix for details. 
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These changes occurred rapidly after the late 1960s. In 1968, the amount of 
revolving credit held by retailers was nearly six times higher than bankcard balances and 
outstanding check credit. Ten years later (1978), banks and retailers held roughly equal 
amounts of revolving credit (Figure 4). Another 15 years later (1993), revolving credit 
held at banks was more than three times higher than balances held by retailers.'^ 

The rapid development of the credit card industry presented both opportunities 
and challenges to credit bureaus in the early 1970s. On the one hand, card-issuing banks 
were a source of new business to credit bureaus. “Pre-screening services” — the process 
in which a card issuer would specify a set of characteristics of potential borrowers used to 
generate a mailing list of people to whom the issuer extends firm offers of credit — 
became a significant source of revenue to the industry. On the other hand, lenders were 
interested in offering credit cards on a regional or national scale, which required access to 
credit tiles that no single bureau held in the late 1 960s. In addition, banks were rapidly 
automating their systems and soon expected to share and obtain data with credit bureaus 
through electronic rather than paper means. To meet these changes, credit bureaus had to 
automate and they had to get larger. 

And that is exactly what happened. The largest credit bureaus already enjoyed 
coverage of one or more large cities, and they soon began to expand their scope by 
acquiring credit bureaus in other cities. ACB membership declined from a peak of 
around 2,200 in 1965 to only about 500 today. After rising for decades, the number of 
credit bureau offices also began to decline, falling 20 percent between 1972 and 1997. 

Credit bureaus in the largest cities were automated first, beginning with Los 
Angeles in 1965, followed by New York and San Francisco in 1967. '“' Shortly thereafter, 
the largest bureaus established networks to access files in any of their automated bureaus 
across the country. As member banks and retailers built up national credit franchises, 
their data made it possible for the largest bureaus to progress toward the goal of in-house 
universal coverage of borrowers. The three largest credit bureaus (today they are called 
TransUnion, Experian, and Equifax) attained universal coverage in the 1980s. 

Most credit bureaus were simply too small to afford the high fixed cost of 
automating with the technology then available. In 1975, two-thirds of ACB member 
bureaus were located in towns with populations of 20,000 or less. As recently as 1 989, 
more than a third of ACB member bureaus had not yet automated and relied upon an 
ACB service to obtain access to information provided by regional and national creditors. 
Nearly 500 independent credit bureaus had automated, but they relied on contracts with 
one or more of the top three bureaus to obtain information provided by larger creditors. 


' ’ If we include securitized revolving credit — mostly issued by banks at the time, but not carried 
on their balance sheets — ^the ratio would be 5; 1 rather than 3:1. 

'■* In 1969 only four ACB member bureaus were partially or fully automated. Six years later, 80 
member bureaus had automated. 
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B. The Consumer Credit Reporting Industry Today 

In 1997, there were just under 1,000 active consumer credit reporting agencies in the 
U.S., employing about 22,000 people and generating $2.8 billion in sales.’" Virtually all 
of these revenues are derived from charges for access to consumer credit reports. 
Controlling for inflation, industry revenues have quadrupled since 1 972 — twice the 
increase in the o verall economy and the stock of consumer credit outstanding. The 
number of credit reports issued today is 10 times higher than 30 years ago, yet industry 
employment is essentially unchanged. Few industries can boast such impressive gains in 
labor productivity. 

The industry is segmented into small and big firms. A typical credit bureau has 
just one office and employs 10 people. Nine-tenths of all firms have annual sales of less 
than $2.5 million. In 1997, only 14 companies had more than five offices. Yet these 
firms accounted for more than a fifth of all offices, half of industry employment, and 
two-thirds of industry receipts. The four largest firms alone account for over half of 
industry receipts. These larger firms concentrate on high volume businesses — those 
firms seeking credit file information thousands or even millions of times a year. They 
also conduct most of the pre-screening services that result in the billions of solicitations 
for credit cards or insurance delivered by mail each year. Smaller firms, on the other 
hand, concentrate on low volume and one-time customers. For these customers, the 
automated technology of the large bureaus has been too costly to justify for such a low 
volume. But with cheap powerful PCs and Internet-based delivery, such costs are falling, 
and this may put additional pressure on the smaller independent bureaus. 

There are also a number of smaller, less well-known credit bureaus that serve 
particular niche markets. Many personal finance companies participate in associations 
(called lenders’ exchanges) that maintain records of credit extended to an individual from 
members in the association. There is a medical credit bureau that primarily serves 
doctors and dentists. Another bureau (the Medical Information Bureau) pools certain 
health information of applicants for life insurance. There are a number of highly 
automated credit bureaus that serve retailers that accept personal checks and banks that 
seek information on customers opening checking accounts (Telecredit, SCAN, and 
Chexsystems). There are a variety of bureaus that serve landlords evaluating prospective 
tenants (Landlord Connections, for example), and there is even a bureau that serves 
telephone companies (the National Consumer Telecommunications Exchange). 

Outside the U.S., consumer credit bureaus are on the rise. A recent World Bank 
survey found at least 25 new private bureaus were created in Europe, Asia, and Latin 
America during the 1990s (Miller 2000). Quite a few' public credit registries were also 
created, especially in Latin America. The big American bureaus have begun to expand 
abroad. Experian, now owned by a British firm, has concentrated on Europe, w'hile 
Equifax has acquired a number of bureaus in Latin America. 


These statistics are from the Census of Service Industries. See the Data Appendix for details. 
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IV. Credit Bureaus as Blaek Sheep 

The American consumer credit reporting industry has a poor reputation in the eyes of 
many consumers. To some degree, credit bureaus are victims of their own success. Few 
people stop to think about the role a credit bureau played in their successfully obtaining 
credit, insurance, or even employment. But when they are denied such things on the 
basis of information contained in a credit report, the credit bureau often gets the blame. 
Consumers are also concerned about the potential loss of privacy that may result from the 
sharing of sensitive financial information. Credit bureaus are concerned about these 
issues too, but it’s unlikely they weigh the benefits and costs of greater accuracy, or 
greater privacy, in the same way most consumers do. It is not surprising, then, that these 
two concerns have been addressed through regulation. 

A. The Quality of Credit Bureau Information 

Credit bureaus obtain account history data from member institutions, sort and aggregate 
these data into personal credit histories, and disseminate this information to members at 
their request. The benefit to members from sharing this information clearly depends on 
its accuracy and timeliness. But members also share in the cost of providing information 
to the bureau. The more costly it is to provide this information, the less attractive it will 
be for a lender to join a bureau, 

1. Economic Intuition 

The level of quality maintained by credit bureaus will depend on a balancing of the costs 
and benefits to their member institutions. This depends, in turn, on the relative costs of 
making and correcting mistakes. Naturally, lenders wish to minimize the cost of 
processing and transmitting the information they are obliged to provide to credit bureaus. 
This is not to say that lenders do not care about the quality of this information — after ali, 
the data are typicaiiy a direct output of their own internal information systems. 

When using credit bureau data, lenders are concerned about two types of errors: A 
type 1 error grants credit to a person based on erroneous information; a type II error 
denies credit to a person based on erroneous information. For lenders, the expected loss 
associated with a type I error (the principal lost) is likely to be higher than the expected 
loss from a type II error (forgone profits on a loan). So given that lenders are both the 
providers and beneficiaries of credit history information, one might expect that credit 
bureau files are more likely to contain erroneous references to delinquencies or defaults 
than they are to mistakenly omit actual delinquencies or defaults. To borrowers, of 
course, the cost of not being able to obtain a loan could well be higher than the cost to a 
lender of not being able to make a loan to that person. To the extent that borrowers' 
losses are not fully reflected in bureaus’ decision-making, there could be too many errors 
and, in particular, too many type II errors. 

When potential borrowers become aware of erroneous information in their credit 
reports, they will have an incentive to dispute it if they can.'® In fact, borrowers enjoy a 


"■ I assume, as current law requires in the U.S,, that the borrower would not confront the problem 
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comparative advantage in identifying such errors. One way to improve the accuracy of 
credit reports is to encourage consumers to dispute errors in their reports, setting in 
motion a process for rechecking the source and accuracy of the data reported. Given 
there is a mutual interest in improving the accuracy of the data, it is not surprising to find 
that credit bureaus encourage consumers to correct errors in their files and devote 
considerable resources (customer service staffing, fee waivers, etc.) to the process.’^ In a 
cross-country sur\'ey. Miller (2000) found that 25 of 43 private bureaus offered free 
credit reports to consumers as a means of correcting errors. Less than half reported using 
statistical or modeling techniques to identify errors. 

Both consumers and lenders share the benefits of any reduction in type II errors 
that result from an efficient dispute process. Of course, they also share in the costs of 
that process. But it is likely that consumers enjoy relatively more of the benefits while 
lenders bear relatively more of the cost of administering the dispute resolution process. 

As a result, from the standpoint of society, credit bureaus may devote too few resources 
to the error correction process.'* What’s more, there may be disputes over the extent of 
proof required in order to reject a consumer’s dispute, how rapidly the di.spute must be 
resolved, etc. These issues suggest a possible role for government regulation. 

2. Data on the Accuracy of Credit Bureau Files 

Perhaps no issue about this industry generates more heated debate than the accuracy of 
credit reports. For all of this heat, relatively little data are available. But we do know 
that the volume of activity in this industry is so large that even a small error rate would 
result in millions of inaccuracies each year. 

In 1989, ACB presented some aggregate statistics about its members. In that 
year, consumers requested some 9 million credit reports, which is about 2 percent of the 
450 million reports generated annually at that time. Consumers disputed about 3 million 
of those reports. About 2 million credit reports were altered in the reverification process. 
Consumers disputed something in their reports about one-third of the time after they saw 
them, and about two-thirds of disputed reports were changed in the reverification process. 
But not all these changes were the result of an error in the report. Some were the result of 
the routine updating of files with the most current information.''* 

Sometimes a credit report will include references to other people and their 
accounts. These errors occur because creditors do not report information on individuals 


of having to dispute an erroneous reference at every credit bureau, nor would the borrower have to deal 
with the re-appearance of an erroneous reference. 

Prior to the passage of the FCRA, some credit bureaus in the U.S. were less receptive to the idea 
of encouraging consumers to investigate their files. Some bureaus actively discouraged lenders from 
disclosing to consumers the name of the bureau or even that a credit j'eport had been obtained. 

This problem is aggravated if some consumers use the dispute process strategically, i.e., by 
disputing accurate derogator>’ information in the hope it will be erroneously removed. In the U.S. this 
phenomenon has become sufficiently widespread to coin a phr^e — tiie credit repair industry. 

19 

At that time, credit bureau files were updated with 2 billion items of information each month. 
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so much as they do on accounts. The credit bureau assembles a report on an individual 
by linking the accounts with the same names, addresses, birthdays, social security 
numbers, and other information that is presumably unique to the individual. But this is 
not a simple exercise in a country with many thousands of lenders and where consumers 
move frequently and are also ambivalent about adopting a universal, unique ID number. 

Credit bureaus have developed sophisticated processes to aggregate account 
information into borrower profiles, but they are not perfect. In an older study Williams 
(1 989) was able to identify errors of this sort in credit reports a little over 1 0 percent of 
the time.^° Such errors are not always innocuous: if the erroneous information includes 
someone else’s delinquencies, for example, a person’s credit rating will be adversely 
affected. Even if the erroneous accounts are in good standing, they make it appear that 
the applicant has more open credit lines than he or she actually does. Sometimes these 
mistakes can affect credit decisions. But how often? 

In the early 1990s, ACB released summary statistics from a study based on a 
sample of nearly 16,000 applicants, all of whom were denied credit (Connelly 1992). 
Relatively few people requested a copy of their credit report, but a quarter of those who 
did disputed something in their report. In about 14 percent of the disputed reports, the 
resulting changes were significant enough to reverse the credit decision. In the study, 
there were only 36 such instances (0.2 percent of the sample). A simple extrapolation, 
based on the previously cited statistics provided by ACB, suggests that in the early 1990s, 
the number of applications for credit mistakenly denied could have been large — in the 
tens if not hundreds of thousands each year.^* 

B. Privacy 

Credit bureaus are information-sharing arrangements that help to reduce the problems of 
adverse selection and moral hazard in credit, insurance, and other markets. The flip side 
of information sharing is necessarily a loss of consumer privacy. It is likely that sharing 
a little information about borrowers, such as their payment history, generates benefits that 
exceed the losses associated with any loss of privacy, especially if consumers are aware 
that such information is being shared and access to the information is limited. When 
access is less well regulated, consumers are less well informed, or information is used for 
purposes not envisioned by consumers, this case becomes harder to make. 

The American credit reporting industry has been embarrassed on several 
occasions by the ease with which people have obtained credit reports when they should 


Less scientific reports produced by Consumers Union (in Michelle Meier’s 1 991 testimony) and 
the Public Interest Research Group (Golinger and Mterzwinski 1 998) found sign ificantly higher error rates. 
See the Data Appendbt. 

13.5 percent of 3 million disputed reports is 405,000. But that number is likely an over- 
estimate for two reasons. First, the frequency ofthe most egregious mistakes is almost certainly higher in a 
sample of consumers denied credit than for the population as a whole (we don’t know how serious the 
selection problem was because the study, prepared by Arthur Andersen, was never published). Second, not 
all of the 3 million reports disputed in 1989 occurred after a denial of credit. So the 405,000 number is 
probably too high. The question is, by how much? 
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not have. In one study, about a third of the bureaus contacted were willing to provide 
credit reports without complying with the requirements of the Fair Credit Reporting Act 
(Green 1991). In 1989, Dan Quay le’s credit report was obtained by a reporter under the 
pretext of making a job offer to the vice president. Certainly some deception was 
required in order to obtain the reports.^^ But it does seem that, at least at the time, a little 
deception went a long way. 

Direct access to the files of the largest credit bureaus is relatively difficult to 
obtain. These companies operate automated systems that serve high volume customers. 
Their size makes it possible for them to afford elaborate and expensive security 
arrangements for their systems. Their customers are primarily lenders who regularly 
provide information on their customers in addition to being frequent users of information 
contained in credit bureau reports. It is relatively easy to police this stable customer base. 

At many of the smaller bureaus, the clientele consists of infrequent or one-time 
users of credit reports. These users are less likely to be providers of credit information to 
the bureau. Some of these bureaus are really just resellers of credit information compiled 
by one or more of the large bureaus. Those bureaus may have a more difficult time 
policing their customers and may not have an adequate incentive to do so. 

On the other hand, it is the larger bureaus that are more likely to market 
information products that have little or nothing to do with applications for credit, 
insurance, or even employment. For example, the largest bureaus offer databases that 
make it possible to match a person’s name or other identifying information to an address 
or phone number (individual reference services). They also prepare targeted mailing lists 
of potential customers for nonfmancial products based on a set of characteristics specified 
by the list buyer, for example, a catalogue company. Credit bureaus are not the only 
firms offering these services, but they are the most controversial. At a minimum, such 
activities create at least the impression that a person’s personal information and payment 
history are being used for purposes completely unrelated to evaluating an application for 
credit. 

V. The Regulation of Consumer Credit Bureaus 

The primary' mechanism for regulating the activities of consumer credit bureaus in the 
U.S. is the Fair Credit Reporting Act (hereafter FCRA).^^ It w'as enacted in 1970 and 
amended several times since, most notably in 1996. The FCRA creates obligations for 
credit bureaus, users of credit reports, and organizations that provide infonnation to credit 
bureaus. The principal agency responsible for enforcing the FCRA is the Federal Trade 


’’ The reporter was writing an article on credit bureaus for Business Week, published by McGraw- 
Hill. In 1998 McGraw-Hill was ordered to pay $7,500 in damages, resulting from a deliberate breach of 
contract, to the credit bureau that provided the information. 

15 U.S.C §§ 1681-168l(u). A summary of the major provisions is found in Appendix A. See 
also Hunt (2002) and the Federal Trade Commission’s web site www.ftc.gov . 
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Commission (FTC), but other federal agencies (including the Federal Reserve Board) are 
also responsible for enforcing the act among firms they regulate?** 

In many ways, this law is an attempt to refine the balance between the obvious 
benefits credit bureaus generate and consumers’ legitimate concerns over accuracy and 
privacy. The FCRA creates obligations for credit bureaus, users of credit reports, and 
credit bureau members. The duties of lenders and other information providers are 
relatively modest — to avoid furnishing information known to be erroneous and to 
participate in the process of correcting errors identified by consumers. This increases the 
quality of information provided to credit bureaus without significantly raising the cost of 
sharing the information. Regulation should not raise these costs to the point where 
information providers drop out, a situation that would undermine a voluntary mechanism 
for sharing infonnation. 

Similarly, inaccuracies in credit files do not violate the FCRA. Rather, the act 
requires bureaus to use reasonable procedures to ensure maximum possible accuracy. 
This standard is satisfied if the bureau adopts procedures a reasonably prudent person 
w'ould use under the circumstances. These procedures, in turn, depend on a balancing of 
the incremental benefits and costs of attaining higher levels of accuracy This balancing 

of benefits and costs may change over time as advances in technology make it easier for 
bureaus to adopt ever more powerful computers and software. 

The FCRA also encourages consumers to correct errors in their reports. The cost 
to consumers of obtaining their own reports is limited by regulation. The cost is free 
whenever information contained in a credit report has contributed to an adverse decision 
affecting the consumer — precisely the circumstance in which an error may be more 
costly. The FCRA requires users of credit bureau information to remind consumers of 
their right to obtain and, if necessary, correct their credit reports. The act sets a time limit 
for reinvestigations to be completed, at no cost to the consumer, and includes a number of 
mechanisms for ensuring that any corrections are disseminated to other credit bureaus 
and users of the report in question. 

This is not to say that the FCRA has attained the ideal balancing of benefits and 
costs that might be achieved. Consumer groups remain concerned about the problems of 
accuracy and privacy and, in some areas, question whether the act is adequate (Golinger 
and Mierzwinski 1998).^** Numerous congressional hearings in the late 1980s and early 
1 990s culminated in amendments, enacted in 1 996. that significantly strengthened 
consumer protections. Thereafter, the FTC sued a number of credit bureaus, alleging 
they were devoting inadequate resources to the consumer-dispute process.**’ At the same 


Under the act, state attorneys general may sue on behalf of their residents. In addition, certain 
state laws provide consumers with additional rights. 

These interpretations are found in the 1982 case Bryant v. TRW, Inc. and the 1989 case Houston 
V. TRW Information Services, Inc. 

See also Edmund Mierzwinski’s 2001 testimony. 

’’ In January 2000, the FTC announced a settlement, involving the three largest credit bureaus, 
that requires them to adequately staff the toll-free lines used by consumers seeking infonnation about their 
credit reports. 
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time, continued improvements in computer and communications technology have 
reduced the cost of investigating alleged errors and correcting them when found.^® 

VI. What Lies Ahead? 

In the U.S., the two-tier industry structure — a few giant credit bureaus with national 
coverage serving high-volume customers and many smaller bureaus serving specific 
niches or reselling data to low-volume customers — is likely to mature while adapting to 
new forms of delivery, for example, the Internet. Advances in predictive modeling such 
as credit scoring will likely increase the value of information contained in credit bureau 
files. But the industry also faces new challenges from governments as well as their own 
customers. 

A. Challenges from Governments 

The industry faces the prospect of more intense scrutiny and possibly regulation. In 2001 
the FTC succeeded in restricting the use of certain data in consumer credit reports to 
generate target-marketing lists used to sell nonfinancial products to consumers. The FTC 
also succeeded in applying the financial privacy requirements of the Gramm-Leach- 
Bliley Act to credit bureaus’ “look-up” seivices, whereby a person’s name and other 
identifying information are matched with a current address or phone number contained in 
credit files.^’ And while the 1996 amendments to the Fair Credit Reporting Act limited 
the ability of states to enact new, more restrictive legislation affecting credit bureaus, 
those limits expire in 2004. Credit bm-eaus may also be affected by the European Privacy 
Directive, which is generally more restrictive than U.S. law (Cate 1997). 

B. Challenges from Lenders 

For a brief period in the late 1990s, lenders accounting for one-half of all consumer credit 
ceased reporting certain information (credit limits and high balances) on at least some of 
their credit card accounts (Fickensher 1999a and 1999b, Lazarony 2000). Financial 
regulators warned lenders their underwriting systems might be compromised by 
incomplete credit bureau information (FFIEC 2000). The leading credit bureaus 
responded by announcing they would limit access to their databases for lenders providing 
incomplete credit histories. Thereafter, these lenders began to send more complete credit 
information to the bureaus. 

This behavior might be a reaction to a period of relatively intense competition for 
new customers by credit card lenders. During this period, an increasing share of 
consmners’ unsecured debt was held on the books of a few lenders. In just five years 


The industry argues that any benefit from the reduction in the unit cost of resolving consumer 
disputes is being offset by rapid growth in the number of reports being disputed. A conservative estimate 
of the industry-wide cost of labor devoted to resolving consumer disputes and instances of identity theft 
would easily exceed $10 million. 

See Trans Union Corp. v. Federal Trade Commission and Individual Reference Services Group, 
Inc. (IRSG), V. Federal Trade Commission et al. 
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(1996-2000), the share of bank credit card balances held by only 10 institutions increased 
from 43 percent to 63 percent (Figure 5)?® These banks are the principal source of 
information about consumers’ payment habits for bankcards, as well as the principal 
soiu'ce of potential new customers. And during those five years, consumers were 
inundated with offers of credit card accounts that carried low introductory interest rates 
on balances transferred from other banks. This episode is a reminder that, in the U.S. at 
least, information sharing among lenders is endogenous. This equilibrium need not 
continue if there are significant changes in the economic or legal environment. 


These statistics are based on Call Report data. If we added back receivables securitized by these 
banks, the concentration ratios would likely be higher. 
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Figure 1 : Shares of Consumer Credit (old series) 
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Source: Federal Reser\'e Board, Banking and Monetar>' Statistics, 1 941-70, 
and author’s calculations. See Data Appendix for details. 


Figure 2: Shares of Consumer Credit 
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Sources: Federal Re.serv'e Board, Consumer Credit (G 19), and author’s calculatiojis. See 
Data Appendix for details. 
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Figure 3: Share of Retails Sales by Regional or National Chains 
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Sources: Census of Retail Trade and author’s calculations. See Data Appendix for 
details. 


Figure 4: Revolving Credit ($ billions, log scale) 



Banks -“-Retailers Securitized Pools 


Sources: Federal Reserve Board, Consumer Installment Cr^tt(G 19), and 
author’s calculations. See Data Appendix for details. 
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Figure 5: Consolidation in the U.S. Credit Card Industry 
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Sources; Call report data and author’s calculations. 
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Appendix A: An Overview of the Fair Credit Reporting Act 


Limitations on Disclosure of Credit Bureau Data 

Credit reports may be furnished only for purposes authorized in the act, for example, to 
lenders making a loan decision, insurers underwriting a policy, or employers considering 
a person for employment, A credit report may be used in an employment decision but 
only with the potential employee's prior consent. Medical information about a consumer 
cannot be shared with creditors, insurers, or employers without the consumer's consent. 

A credit report may also be issued to any person with a legitimate business need arising 
from a transaction initiated by the consumer or with an existing account with a consumer. 
An example might be a credit check performed by a prospective landlord. 

The FCRA was initially interpreted and later modified to explicitly permit a process 
c&WeA prescreening. This is the process of generating lists of customers to be sent firm 
offers of credit or insurance, based on criteria specified by a lender or insurance 
company, without obtaining the prior consent of the consumers. Consumers can call a 
single 800 number to opt out of prescreening services provided by the three national 
credit bureaus. 

Under the FCRA, credit bureaus must use reasonable procedures to prevent disclosures 
of consumers’ information that violate the act. Users of credit bureau information must 
identify themselves and the reason why a credit report is being sought. Credit bureaus 
must make a reasonable effort to verify this information when dealing with new 
customers. When a consumer report is purchased for resale to an end-user, the identity of 
the end-user and the proposed use of that report must be provided to the credit bureau. 

The FCRA specifies penalties for violations of consumers’ privacy. A credit bureau or a 
user of a credit report found to be in negligent noncompliance with the act is responsible 
for the consumer’s actual damages plus his or her reasonable legal expenses. Punitive 
damages may be awarded in instances of willful noncompliance. Officers or employees 
of a credit bureau who knowingly or willfully disclose consumer information to a person 
not authorized to receive it can be prosecuted. Any person who obtains a consumer 
report under false pretenses is subject to criminal prosecution and can be sued by the 
credit bureau for actual damages. 

Accuracy of Credit Bureau Data 

Duties of Credit Bureaus. Credit bureaus must use reasonable procedures to assure 
maximum possible accuracy of the information contained in credit reports. This standard 
is satisfied if the bureau adopts procedures like those a reasonably prudent person would 
use under the circumstances. 
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Credit reports may not include negative credit information that is more than seven years 
old or bankruptcies that are more than 10 years old. Suits or impaid judgments may not 
be included after seven years unless the relevant statute of limitations runs longer.' 

Duties of Lenders and Other Information Providers. A provider of information to a 
credit bureau may not be sued by a consumer for noncompliance with the FCRA unless it 
failed to review all the information provided to it by the credit bureau when 
reinvestigating a file at the request of the consumer. 

A lender may not furnish credit bureaus with information it knows, or consciously avoids 
knowing, is inaccurate. If it regularly furnishes information to a credit bureau and 
discovers an inaccuracy, it must notify the bureau of the error and correct the 
information. Lenders must notify credit bureaus of accounts that are voluntarily closed 
by a customer. If a consumer has contacted the firm to dispute information it has 
provided to a credit bureau, the dispute must be noted when that information is 
subsequently reported to the credit bureau. 

Procedures for Dispute Resolution. Anyone who makes an adverse decision — such as 
denying an application for credit, insurance, or employment — on the basis of information 
contained in a credit report must inform the consumer and provide the name, address, and 
phone number of the bureau that furnished the report.^ The consumer must also be given 
a disclosure describing his or her rights under the FCRA. 

Consumers may obtain copies of their credit report at any time for a fee that is capped by 
regulation. If a consumer experiences an adverse decision on the basis of information 
contained in a credit report, he or she is entitled to a free copy of the report. Consumers 
must receive all the information in their file, including any medical information, and the 
sources of the underlying data must also be reported.^ The consumer must also be given 
the identity of any person who procured his or her credit report in the last year, two years 
if the purpose was employment related. 

Consumers may dispute an item in their credit report simply by writing to the credit 
bureau and explaining why the information in question is inaccurate. At a minimum, the 
bureau must forward this complaint to the provider of the information in question, which 
must then investigate the item. The information provider must report back to the bureau, 
which in turn informs the consumer of the outcome of the investigation. If the 


' These limitations do not apply in cases where a credit report is used for the purposes of an 
application for credit or life insurance exceeding $150,000 or for a position with a salary that exceeds 
$75,000. Also there is no limitation on the reporting of criminal convictions. 

^ If the adverse decision pertains to an extension of credit but is based on information other than a 
credit report, the consumer has a right to request an explanation for this decision. The creditor must 
respond to such a request within 60 days. 

’ But the FCRA does not require that credit bureaus include credit scores in their disclosure to 
consumers who request their reports. 
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information provider had previously sent the erroneous information to one of the national 
credit bureaus, it must also send the corrected information to them. 

If the result is a change in the credit report, the consumer receives a free copy of the 
revised report and may request tliat it be sent to anyone who recently obtained a copy of 
his or her report. If the investigation does not resolve the dispute, the consumer may 
insert a brief statement about the item in his or her file. 

A credit bureau must remove or correct inaccurate information from its files within 30 
days after it is disputed. The FCRA does not require credit bureaus to remove accurate 
data from a file unless it is either outdated or cannot be verified. If a dispute results in a 
change in the credit report, the disputed information cannot be reinserted unless it is 
reverified by the information source and the consumer is given notice of the change in his 
or her file. 

Preemption of State Law 

The FCRA prohibits consumers from suing for defamation, invasion of privacy, or 
negligence (under state law) resulting from information that is contained in their credit 
report. This prohibition applies to suits against credit bureaus, users of credit reports, and 
information providers. This prohibition does not apply, however, where false 
information is furnished with malice or willful intent to injure a consumer. 

The 1996 amendments to the act prohibit states from enacting new legislation related to 
certain portions of the law until 2004. The prohibition applies to new limits on the 
amount of time that derogatory information can be retained in credit reports, the amount 
of time allowed for credit bureaus to respond to a consumer dispute, additional duties of 
firms that provide infonnation to credit bureaus, or new restrictions on the ability of 
credit bureaus to offer prescreening services to companies making firm offers of credit or 
insurance. 
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Consumer Credit Extended by Retailers and Finaneial Institutions 

The share of retail sales financed via retailer credit in 1929 is derived from the 1930 
Census of Business. This calculation excludes paper, primarily automobile loans, 
financed or purchased by finance companies. The shares of open account sales for 
various categories of stores in 1935 are from a reprint of the 1935 survey in the 1939 
Survey of Business. 

Calculations for the growth of consumer credit held by retailers and financial companies 
and the respective shares of consumer credit held by these categories are based on data 
contained in Banking and Monetary Statistics, 1941-70. 

The shares of consumer credit for more recent years are derived from the Federal Reserv'e 
statistical release G.19 Consumer Installment Credit, published monthly. The edition 
used, together with the most recent version of the historical series (found at the Board's 
web site), is from October 2001, 

It should be noted that survey coverage, categories of lenders (including retailers), and 
categories of loans vary depending on the vintage of data being used. For example, 
consumer credit is sometimes divided into installment credit and other credit, but how 
that is done varies over time. Also, a separate breakdown for retailers disappears in 
releases after the mid 1 990s. Thereafter, a breakdown for non-fmancial companies 
(mostly retailers) is reported. 

Comparisons of the growth rate of consumer credit relative to consumer spending rely on 
the most recent version of the National Income and Product Accounts for years after 
1928. For the period 1919 to 1928, these calculations are based on series E 135 (CPI all 
items) and G 470 (personal consumption expenditures) in the Historical Statistics of the 
United States, Colonial Times to 1970. 

The statistics on revolving credit held by retailers and commercial banks (Figure 4) are 
based on a variety of tabulations published by the Federal Reserve System. These 
mchxdeihs Annual Statistical Digest (\91Q-19, 1980-89, 1991, 1992, 1993, 1994), the 
Federal Reserve Bulletin (December 1968, October 1972, and December 1975), and 
revisions to the Consumer Installment Credit series published in April 1986 and May 
1 993. After 1 970, banks’ revolving credit includes check credit. Revolving credit at 
retailers includes gasoline stations. Because of changes in reporting of the series, there is 
no consistent data for revolving credit at retailers for 1975. The year-end number for 
1976 is derived from the January 1977 number for revolving credit at retailers, less the 
proportionate share of the increase in credit held by retailers. 

Shares of Retail Sales Aeeounted for by Regional and National Chains. 

For 1929, the shares are calculated using the Census Bureau’s categories of "sectional or 
national" chains as reported in the 1930 Census of Business. Shares for later years are 
calculated using firms with 26 or more stores, as reported in the 1 939 Census of Business 
and the Census of Retail Trade thereafter. The 1939 census also reports data categorized 
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as sectional or national chains, and for most categories of retailers, these are comparable 
to the numbers reported for firms with 26 or more stores. 

Consumer Credit Reporting Agencies 

Data on the number of offices, employment, receipts, and concentration ratios are from 
the Census of Service Industries as reported in 1972 and more recent editions. The 
numbers for 1997 are for the industry code 5614501 in the new North American Industry 
Classification System (NAICS). The numbers reported for previous years are based on 
the old Standard Industrial Classification System (SICS) industry group 7323, but only 
where information about consumer credit reporting agencies is broken out separately 
from mercantile credit reporting agencies. Unfortunately, there is not enough publicly 
available information to calculate concentration ratios in years prior to 1 997. 

Data on the number of credit reports issued, the number of credit bureaus, and the 
composition of ACB membership are from testimony provided by the organization in the 
transcripts of the 1970 and 1975 hearings in the House of Representatives. Information 
on the organization of credit bureaus and the extent of automation in the late 1980s is 
from ACB testimony contained in the transcripts of the 1989 hearings in the House of 
Representatives. The most recent data on the number of members and indicators of 
activity are from ACB’s web site, as reported in October 2001. Information about the 
major credit bureaus' other lines of businesses were found on the companies' web sites. 

Errors in Consumer Credit Reports 

The aggregate statistics from ACB are from its response to questions printed in the 
transcripts of the September 1989 hearings in the House of Representatives (p. 855). The 
same hearings report statistics for TRW that are comparable (p. 796, pp. 801-2). 

The statistic on the frequency of mismerge errors is from the study prepared by James R. 
Williams in 1989. Williams identified errors in the rating of an account (satisfactory or 
delinquent, for example) in about 1 3 percent of 350 credit reports. This report was re- 
printed in the transcripts to the June 1990 hearings in the House of Representatives (pp. 
517-39). 

The article refers to surveys conducted by two consumers groups. The Consumers Union 
survey is reprinted in the transcripts of the June 1991 hearings in the House of 
Representatives (pp. 425-35). The other is the Public Interest Research Group’s 1998 
study, which can be found at http://wwft'.pirg.org/reports/consumer/mistakes/index.htm . 
The samples in these surveys are quite small, 57 and 131, respectively, and were not 
drawn randomly from the population of credit users. 

The statistics from the Arthur Andersen study are from the National Press Club speech by 
D. Barry Connelly, executive vice president of ACB. While the sample size of the 
Andersen study is quite large — over 15,000 applicants who were denied credit — ^the 
results are based on a small set of those applicants. About 1,200 requested copies of their 
credit report and about 300 of those disputed their reports. In 36 of 267 instances 
analyzed, the lender reversed the credit decision. 



